CVE-2026-71922: NULL Pointer Dereference in DrayTek Corporation VigorSwitch G2540xs

CVE-2026-71922 is a null pointer dereference vulnerability in the setget.cgi interface of DrayTek VigorSwitch devices, including the G2540xs model. The vulnerability arises from improper input validation when the 'pass' field is missing in a request, allowing an unauthenticated remote attacker to cause a denial of service by crashing the service. This vulnerability affects multiple VigorSwitch models and has a CVSS 4.0 base score of 8.7, indicating high severity. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation results in a denial of service by crashing the affected service on the device. This can disrupt network operations relying on the VigorSwitch device. There is no indication of privilege escalation, data disclosure, or code execution from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the setget.cgi interface from untrusted networks to reduce exposure. Monitor vendor channels for updates or official patches.