Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2026-71936

DrayTek VigorSwitch Multiple Models Buffer Overflow via sysreboot

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71931

DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71941

DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71926

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71921

DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71916

DrayTek VigorSwitch Multiple Models OS Command Injection via commandTable

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71943

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevNet

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71938

DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71933

DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions

Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted requests to modify configuration, restart services, save startup configuration, or clear logs.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71928

DrayTek VigorSwitch Multiple Models OS Command Injection via fdftDevice

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71923

DrayTek VigorSwitch Multiple Models OS Command Injection via auth_set

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71918

DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71939

DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Add ACE

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71934

DrayTek VigorSwitch Multiple Models Buffer Overflow via pingtrace

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71929

DrayTek VigorSwitch Multiple Models OS Command Injection via setDevProto

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71924

DrayTek VigorSwitch Multiple Models OS Command Injection via getVid

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71919

DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71915

DrayTek VigorSwitch Multiple Models OS Command Injection via jsonstatus

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71942

DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more
CVE-2026-71940

DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Draytek
Products
Vigorswitch Fx2120 Firmware Vigorswitch G1282 Firmware Vigorswitch G2100 Firmware and 11 more