Threat database

CVE-2026-71943 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of username and password inputs in the setDevNet function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges via the device's web management interface.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

A buffer overflow vulnerability exists in the diag_logmail function of DrayTek VigorSwitch G2540xs devices. This occurs because multiple smtpReceiver email addresses are concatenated into a fixed-size buffer without verifying available space. An attacker with valid administrative credentials on the device's web management interface can exploit this flaw to cause denial of service or potentially execute arbitrary commands.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

A buffer overflow vulnerability exists in the DrayTek VigorSwitch G2540xs models within the switch_lan_gvrp function. This flaw arises from unsafe copying of the portList field into an undersized buffer. Exploitation requires valid administrative credentials to the device's web management interface and can lead to denial of service or potentially arbitrary command execution.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

A buffer overflow vulnerability exists in the sysreboot function of DrayTek VigorSwitch G2540xs devices. This flaw arises from unsafe concatenation of input data into a fixed-size buffer. An attacker with valid administrative credentials to the device's web management interface can exploit this to cause denial of service or potentially execute arbitrary commands. The vulnerability has a high severity rating with a CVSS score of 8.6.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

DrayTek VigorSwitch G2540xs contains multiple unauthorized operation vulnerabilities due to missing authorization checks in syslog functions. A remote attacker can exploit these flaws to modify device configuration, restart services, save startup configuration, or clear logs without authentication. The vulnerability has a high severity score of 8.8 CVSS 4.0. No patch or official remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71931 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient input filtering in the tftp_upgrade function, allowing an attacker with valid administrative credentials to execute arbitrary commands with root privileges via crafted input. This vulnerability requires authenticated access to the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71928 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of username and password fields in the fdftDevice function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges (admin access). No patch or official remediation information is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71926 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient sanitization of username, password, and location fields in the setDevice function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.