NCSC-2026-0328 [1.00] [M/H] Kwetsbaarheden verholpen in DrayTek VigorSwitch
DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorSwitch productlijn. De kwetsbaarheden betreffen voornamelijk command injection, buffer overflow, null pointer dereference, directory traversal en onvoldoende autorisatiecontroles in diverse functies van de DrayTek VigorSwitch apparaten. Command injection kwetsbaarheden bevinden zich onder andere in functies zoals jsonstatus, commandTable, pingtrace, webBackupAction, sysreboot, auth_set, getVid, getDetail, setDevice, rebDevice, fdftDevice, setDevProto, setTime, tftp_upgrade en setDevNet. Deze maken het mogelijk voor een aanvaller om willekeurige commando's met root privileges uit te voeren. Sommige command injection kwetsbaarheden zijn pre-authenticatie, zoals in de setget.cgi interface, waardoor geen voorafgaande authenticatie vereist is voor exploitatie. Buffer overflow kwetsbaarheden zijn aanwezig in functies zoals pingtrace, webBackupAction, sysreboot, poe_schedule_profile, switch_lan_gvrp, acl_general_setup Add ACE en Edit ACE, diag_logmail en mail_mailalert. Deze kunnen leiden tot denial of service of uitvoering van willekeurige code onder administratieve rechten. Null pointer dereference kwetsbaarheden in formlogout en setget.cgi kunnen leiden tot een denial of service door het crashen van de service. Directory traversal in getSyslogFile maakt het mogelijk om, mits geauthenticeerd, toegang te krijgen tot willekeurige bestanden op het systeem. Onvoldoende autorisatiecontroles in syslog functies stellen een aanvaller in staat om configuraties te wijzigen, services te herstarten, configuraties op te slaan of logs te wissen zonder de juiste rechten. Exploitatie van deze kwetsbaarheden vereist in de meeste gevallen geldige administratieve credentials, behalve bij de pre-authenticatie command injection en null pointer dereference in setget.cgi.
CSIRTS triage
- What
- Multiple vulnerabilities including command injection, buffer overflow, null pointer dereference, directory traversal, and insufficient authorization controls allow arbitrary code execution and system compromise.
- Who is affected
- VigorSwitch devices with affected firmware versions, some exploitable without authentication.
- Urgency
- High priority; pre-authentication command injection vulnerabilities enable remote root-level code execution.
- Action
- Apply DrayTek firmware patches addressing CVE-2026-71915 through CVE-2026-71922 to all affected VigorSwitch models.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch VigorSwitch
Get an email when a new VigorSwitch advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0328
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-719153.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719162.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719173.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719183.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719193.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-719200.39% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719213.2% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 88% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-719220.47% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719231.7% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 75% of all EPSS-scored CVEs.
- Moderate exploitation riskCVE-2026-719243.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- medium[NEW] [medium] DrayTek Vigor Switches: Multiple Vulnerabilities Enable Code Executioncert-bund
- highCVE-2026-71943: Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet…nvd
- highCVE-2026-71942: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailal…nvd
- highCVE-2026-71941: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmai…nvd
- highCVE-2026-71940: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general…nvd
- highCVE-2026-71939: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general…nvd
- highCVE-2026-71938: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_…nvd
- highCVE-2026-71937: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedul…nvd
- highCVE-2026-71936: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot f…nvd
- highCVE-2026-71935: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAc…nvd
- highCVE-2026-71934: Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace f…nvd
- criticalCVE-2026-71933: Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple…nvd
Recent advisories for Kwetsbaarheden verholpen in
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Azurencsc-nl · 2026-09-14
- unknownexploitedNCSC-2026-0076 [1.03] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Centerncsc-nl · 2026-09-12
- unknownexploitedNCSC-2026-0076 [1.02] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Centerncsc-nl · 2026-09-11
- unknownNCSC-2026-0366 [1.00] [M/H] Kwetsbaarheden verholpen in Arista EOSncsc-nl · 2026-09-11
- unknownNCSC-2026-0365 [1.00] [H/H] Kwetsbaarheden verholpen in Check Point VPN productenncsc-nl · 2026-09-10
- unknownNCSC-2026-0364 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Illustratorncsc-nl · 2026-09-09
More from NCSC-NL Advisories
- unknownNCSC-2026-0347 [1.01] [M/H] Kwetsbaarheden verholpen in Microsoft Azure2026-09-14
- unknownNCSC-2026-0076 [1.03] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center2026-09-12
- unknownNCSC-2026-0367 [1.00] [H/H] Kwetsbaarheid verholpen in GitLab Community en Enterprise Editions2026-09-12
- unknownNCSC-2026-0271 [1.01] [M/H] Kwetsbaarheid verholpen in Cisco Secure Firewall Management Center2026-09-11
- unknownNCSC-2026-0076 [1.02] [H/H] Kwetsbaarheden verholpen in Cisco Secure Firewall Management Center2026-09-11