CVE-2026-71933 DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

EUVD-2026-64993

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via...

CVE-2026-71933

DrayTek VigorSwitch (multiple models) is affected by unauthorized operation vulnerabilities in its syslog functions , caused by missing authorization checks . A remote unauthenticated attacker can send crafted requests to modify configuration , restart services , save startup configuration , or c...

EUVD-2026-64992

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save...

CVE-2026-71932 DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to acce...

EUVD-2026-64991

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to acce...

CVE-2026-71932

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function, caused by insufficient validation of the option field. A remote attacker with valid administrative credentials for the device's web management interface can supply crafted input containi...

EUVD-2026-64990

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftpupgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71931 DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftpupgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71931

Multiple DrayTek VigorSwitch models are affected by an OS command injection vulnerability in the tftp_upgrade function. The root cause is insufficient filtering of the filename field before it is concatenated into a system command, allowing a remote attacker to execute arbitrary commands with roo...

EUVD-2026-64989

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

CVE-2026-71929

Multiple DrayTek VigorSwitch models contain an OS command injection vulnerability in the setDevProto function, caused by insufficient filtering of the username and password fields before command execution. A remote attacker with valid administrative credentials for the device's web management int...

CVE-2026-71930

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function, caused by insufficient filtering of username and password fields before command execution. A remote attacker with valid administrative credentials on the device's web management interface can cr...

CVE-2026-71929 DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to...

CVE-2026-71930 DrayTek VigorSwitch Multiple Models OS Command Injection via setTime

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute...

EUVD-2026-64988

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to...

CVE-2026-71928

Multiple DrayTek VigorSwitch models are affected by an OS command injection vulnerability in the fdftDevice function, caused by insufficient filtering of the username and password fields before command execution. A remote attacker with valid administrative credentials for the device's web managem...

EUVD-2026-64987

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu...

CVE-2026-71928 DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execu...

EUVD-2026-64986

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execut...