What’s Vulnerable › Vulnerabilities

CVE-2026-71933: DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-862

Description

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

Affected products

• DrayTek Corporation VigorSwitch FX2120: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch G2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1281x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch P2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch P2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P2542xh: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch PQ2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2200xb: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2300xb: before 2.10.7 — fixed in 2.10.7
• DrayTek Corporation VigorSwitch PX2060: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2200x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2300x: before 2.10.7 — fixed in 2.10.7

How to fix

Upgrade to a fixed version: DrayTek Corporation VigorSwitch FX2120 3.9.10; DrayTek Corporation VigorSwitch G1280 2.9.10; DrayTek Corporation VigorSwitch G1282 2.9.10; DrayTek Corporation VigorSwitch G2100 2.9.10; DrayTek Corporation VigorSwitch G2121 2.9.10; DrayTek Corporation VigorSwitch G2280x 2.9.10; DrayTek Corporation VigorSwitch G2282x 2.10.6; DrayTek Corporation VigorSwitch G2540x 2.9.10; DrayTek Corporation VigorSwitch G2540xs 3.9.10; DrayTek Corporation VigorSwitch G2542x 3.10.6; DrayTek Corporation VigorSwitch P1280 2.9.10; DrayTek Corporation VigorSwitch P1281x 2.9.10. Check the vendor advisory for mitigations.

References

• https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
• https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-missing-authorization-in-syslog-functions

Get alerted when CVE-2026-71933 or the next vulnerability affects your stack