Kwetsbaarheden verholpen in DrayTek VigorSwitch

The Nationaal Cyber Security Centrum has fixed multiple vulnerabilities in the DrayTek VigorSwitch product line, including 29 CVEs such as CVE-2026-71915 through CVE-2026-71943. The vulnerabilities cover several CWE categories: CWE-78 (OS Command Injection), CWE-476 (Null Pointer Dereference), CWE-22 (Path Traversal), CWE-862 (Authorization Bypass), and CWE-120 (Buffer Overflow). The advisory does not specify affected versions or patch availability. No known exploits have been reported in the wild.

The vulnerabilities could allow attackers to execute arbitrary commands, cause denial of service through null pointer dereferences, access unauthorized files via path traversal, bypass authorization controls, or trigger buffer overflows. These impacts could compromise device integrity, confidentiality, and availability. However, no active exploitation has been reported, and the extent of impact depends on the specific vulnerability and environment.

The advisory states that multiple vulnerabilities have been fixed, implying that patches or updates are available. Users of DrayTek VigorSwitch products should apply the official updates provided by DrayTek or follow guidance from the Nationaal Cyber Security Centrum. Since no explicit patch links or detailed remediation instructions are provided, users should consult the vendor's official security advisories for the latest patches and instructions.