Threats Tagged 'cve-2026-71920'

Multiple vulnerabilities have been addressed in the DrayTek VigorSwitch product line by the Nationaal Cyber Security Centrum. These issues include a range of weaknesses such as command injection, null pointer dereference, path traversal, authorization bypass, and buffer overflow. The affected products include DrayTek VigorSwitch FX2120 and potentially other versions, though exact affected versions are not specified. No CVSS score is available for these vulnerabilities. There is no indication of known exploits in the wild. Patch or remediation details are not provided in the source data.

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.