CVE-2026-71933: Missing Authorization in DrayTek Corporation VigorSwitch G2540xs

CVE-2026-71933 affects DrayTek VigorSwitch G2540xs models by allowing remote attackers to perform unauthorized operations on syslog-related functions. The root cause is missing authorization checks, enabling attackers to send crafted requests that can modify configurations, restart services, save startup configurations, or clear logs remotely without any privileges. The CVSS 4.0 base score is 8.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

An attacker can remotely execute unauthorized actions on the affected switch, including changing configurations, restarting services, saving startup configurations, and clearing logs. This can lead to disruption of network operations, loss of audit trails, and potential compromise of device integrity. The vulnerability does not require authentication or user interaction, increasing the risk of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to management interfaces of the affected devices and monitor for suspicious activity related to syslog functions.