8.6
CVE-2026-71938
- EPSS 0.48%
- Veröffentlicht 24.08.2026 17:08:02
- Zuletzt bearbeitet 26.08.2026 17:17:13
- Erkennungen
DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2540xs
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2540xs
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch FX2120
Default Statusunaffected
Version
0
Version <
3.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2282x
Default Statusunaffected
Version
0
Version <
2.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2282x
Default Statusunaffected
Version
0
Version <
2.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2300x
Default Statusunaffected
Version
0
Version <
2.10.7
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2300xb
Default Statusunaffected
Version
0
Version <
2.10.7
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2542x
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2542x
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2542xh
Default Statusunaffected
Version
0
Version <
3.10.6
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PX2060
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G1280
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1280
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1281x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G1282
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P1282
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2121
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2121
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2121x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2121x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2280x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2280x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch Q2200x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch PQ2200xb
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2100
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2100
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch G2540x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
HerstellerDrayTek Corporation
≫
Produkt
VigorSwitch P2540x
Default Statusunaffected
Version
0
Version <
2.9.10
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.48% | 0.391 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 8.6 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 7.2 | 1.2 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-switch-lan-gvrp