The vulnerability CVE-2026-71933 affects multiple DrayTek VigorSwitch models, including the G2540xs, due to missing authorization checks in syslog-related functions. This security flaw enables remote attackers to send crafted requests that bypass authentication and perform unauthorized actions like configuration changes, service restarts, saving startup configurations, and log clearing. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and availability. The vulnerability is publicly disclosed but lacks an official patch or remediation level at this time.

An unauthenticated remote attacker can exploit this vulnerability to modify device configurations, restart services, save startup configurations, or clear logs without authorization. This can lead to disruption of network operations, loss of configuration integrity, and potential evasion of forensic analysis due to log clearing. The high CVSS score reflects the critical nature of these impacts on confidentiality and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the affected devices to trusted administrators only and monitor for unusual configuration changes or service restarts. Avoid exposing the management interfaces of the VigorSwitch G2540xs to untrusted networks.