CVE-2026-71920: NULL Pointer Dereference in DrayTek Corporation VigorSwitch G2540xs

Multiple DrayTek VigorSwitch models, including the G2540xs, contain a null pointer dereference vulnerability in the formlogout function. The issue is due to the lack of validation for the Cookie header before processing it as a string. A remote attacker who possesses valid administrative credentials to the device's web management interface can exploit this vulnerability by sending a specially crafted request that triggers the null pointer dereference, resulting in a service crash and denial of service condition.

Successful exploitation causes the device's service to crash, leading to denial of service. Exploitation requires valid administrative credentials, limiting the attacker's capabilities to those with elevated privileges. There is no indication of code execution or data disclosure from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for unusual administrative activity. No official fix or workaround has been documented at this time.