CVE-2026-71933
CriticalCVSS 9.1Summary
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.
Risk Assessment
An attacker without authorization can change device configuration, disrupt services, or delete logs, potentially leading to system integrity compromise and loss of audit trails.
Recommendation
Update DrayTek VigorSwitch firmware to the latest version that includes authorization fixes.
Original NVD description (English source)
Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.