What’s Vulnerable › Vulnerabilities

CVE-2026-71920: DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

• Severity: medium (CVSS 4.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-13
• Weakness: CWE-476

Description

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

• DrayTek Corporation VigorSwitch FX2120: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch G2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1281x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch P2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch P2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P2542xh: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch PQ2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2200xb: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2300xb: before 2.10.7 — fixed in 2.10.7
• DrayTek Corporation VigorSwitch PX2060: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2200x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2300x: before 2.10.7 — fixed in 2.10.7

How to fix

Upgrade to a fixed version: DrayTek Corporation VigorSwitch FX2120 3.9.10; DrayTek Corporation VigorSwitch G1280 2.9.10; DrayTek Corporation VigorSwitch G1282 2.9.10; DrayTek Corporation VigorSwitch G2100 2.9.10; DrayTek Corporation VigorSwitch G2121 2.9.10; DrayTek Corporation VigorSwitch G2280x 2.9.10; DrayTek Corporation VigorSwitch G2282x 2.10.6; DrayTek Corporation VigorSwitch G2540x 2.9.10; DrayTek Corporation VigorSwitch G2540xs 3.9.10; DrayTek Corporation VigorSwitch G2542x 3.10.6; DrayTek Corporation VigorSwitch P1280 2.9.10; DrayTek Corporation VigorSwitch P1281x 2.9.10. Check the vendor advisory for mitigations.

References

• https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
• https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-null-pointer-dereference-via-formlogout

Get alerted when CVE-2026-71920 or the next vulnerability affects your stack