6.9
CVE-2026-71932
- EPSS 0.69%
- Veröffentlicht 24.08.2026 17:07:58
- Zuletzt bearbeitet 26.08.2026 17:08:22
- Erkennungen
DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2540xs
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2540xs
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch FX2120
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2282x
Default Statusunaffected
Version
0
Version <
2.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2282x
Default Statusunaffected
Version
0
Version <
2.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2300x
Default Statusunaffected
Version
0
Version <
2.10.7
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2300xb
Default Statusunaffected
Version
0
Version <
2.10.7
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2542x
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2542x
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2542xh
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PX2060
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G1280
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1280
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1281x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G1282
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1282
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2121
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2121
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2121x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2121x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2280x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2280x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2200x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2200xb
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2100
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2100
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2540x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2540x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.69% | 0.502 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 6.9 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 4.9 | 1.2 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
|
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-path-traversal-via-getsyslogfile