DrayTek VigorSwitch: 25 Vulnerabilities Including Critical Command Injection Disclosed Together
DrayTek VigorSwitch devices are affected by a batch of 25 vulnerabilities, including critical command injection and buffer overflow flaws, disclosed on August 24, 2026.
Key findings
- 25 vulnerabilities disclosed on August 24, 2026, for DrayTek VigorSwitch devices.
- Multiple command injection flaws, including pre-authentication critical vulnerabilities like CVE-2026-71923.
- Numerous buffer overflow vulnerabilities impacting stability and potentially allowing code execution.
- Other issues include unauthorized operations, directory traversal, and null pointer dereferences.
- All vulnerabilities require immediate patching via firmware updates.
On August 24, 2026, a significant batch of 25 vulnerabilities was disclosed for DrayTek VigorSwitch devices. These vulnerabilities, all disclosed on the same day, span a range of severity levels from Medium to Critical, with a notable cluster of High severity command injection and buffer overflow flaws. The sheer volume and nature of these vulnerabilities indicate a widespread issue within the VigorSwitch product line, potentially exposing numerous devices to remote exploitation.
A significant portion of the disclosed vulnerabilities are related to command injection. CVE-2026-71943, CVE-2026-71931, CVE-2026-71930, CVE-2026-71929, CVE-2026-71928, CVE-2026-71927, CVE-2026-71926, CVE-2026-71925, CVE-2026-71924, CVE-2026-71923, and CVE-2026-71919 all stem from insufficient filtering or sanitization of user-supplied input in various functions, allowing remote attackers to execute arbitrary commands. CVE-2026-71923, in particular, is a pre-authentication command injection vulnerability in the setget.cgi interface, carrying a Critical severity rating.
Another prominent group of vulnerabilities involves buffer overflows, including CVE-2026-71942, CVE-2026-71941, CVE-2026-71940, CVE-2026-71939, CVE-2026-71938, CVE-2026-71937, CVE-2026-71936, and CVE-2026-71935. These flaws arise from improper handling of input data, such as concatenated email addresses or configuration fields, without adequate length validation, potentially leading to denial-of-service conditions or even arbitrary code execution.
Beyond command injection and buffer overflows, other vulnerabilities include unauthorized operation flaws (CVE-2026-71933), directory traversal (CVE-2026-71932), and null pointer dereferences (CVE-2026-71922, CVE-2026-71920). The unauthorized operation vulnerabilities (CVE-2026-71933) allow remote attackers to modify configurations or restart services without proper authorization, while the directory traversal vulnerability (CVE-2026-71932) could enable access to sensitive files on the system. The null pointer dereferences, particularly CVE-2026-71922 in the pre-authentication setget.cgi interface, can lead to service crashes and denial of service.
The critical nature of several of these vulnerabilities, especially those allowing pre-authentication command execution and unauthorized operations, poses a significant risk to organizations using DrayTek VigorSwitch devices. The lack of input validation across multiple functions and interfaces suggests a systemic weakness that attackers could leverage to gain control over network infrastructure.
DrayTek has released firmware updates to address these vulnerabilities. Users are strongly advised to consult DrayTek's official advisories for specific version information and to update their VigorSwitch devices to the latest firmware as soon as possible to mitigate these risks. The widespread nature of these flaws underscores the importance of regular security audits and timely patching for network infrastructure devices.
This coordinated disclosure event highlights the critical need for vigilance in securing network edge devices. The breadth of vulnerabilities, from command injection to buffer overflows and authorization bypasses, presents a complex threat landscape for VigorSwitch users. Prompt patching and awareness of these issues are paramount to maintaining the security and integrity of network operations.
The vulnerabilities were disclosed on August 24, 2026. The affected product is DrayTek VigorSwitch.
Key vulnerabilities include:
- Multiple command injection flaws (e.g., CVE-2026-71943, CVE-2026-71923) allowing arbitrary code execution.
- Numerous buffer overflow vulnerabilities (e.g., CVE-2026-71942, CVE-2026-71935) leading to denial of service or code execution.
- Critical pre-authentication vulnerabilities (CVE-2026-71933, CVE-2026-71923) enabling unauthorized operations and command execution without prior authentication.
- Directory traversal (CVE-2026-71932) and null pointer dereference (CVE-2026-71922) vulnerabilities further expanding the attack surface.
- All 25 vulnerabilities were disclosed on the same day, indicating a coordinated disclosure event.
The prompt should focus on the network switch aspect and the variety of vulnerabilities. A stylized network switch diagram with different colored lines representing various types of vulnerabilities (command injection, buffer overflow, etc.) emanating from it. The lines should be abstract and not contain any text. The overall tone should be technical and serious.