EUVD-2026-64979
GHSA-648m-vmc5-h63x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management interface but requires admin credentials (PR:H); impact is a service crash with no scope change, confidentiality, or integrity effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.
AnalysisAI
Null pointer dereference in DrayTek VigorSwitch's formlogout web management function allows authenticated remote administrators to crash the management service, causing a denial of service across 28+ switch models spanning the G, P, Q, FX, and PX product lines. The flaw stems from absent validation of an empty or missing Cookie header before string handling in the formlogout handler, and is patched in firmware versions released under DrayTek's August 2026 security advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVE description explicitly states that exploitation requires valid administrative credentials for the device's web management interface - this is the primary and decisive constraint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately characterizes the risk: the management interface is network-reachable without complexity, but the mandatory admin credential prerequisite (PR:H) sharply constrains the realistic attacker pool to those who have already achieved privileged access through a separate compromise path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected VigorSwitch firmware to the patched release for each model family: version 2.9.10 or later for the majority of affected models (G2540x, P2540x, PX2060, Q2200x, PQ2200xb, G2280x, P2280x, G2100, P2100, G1280, P1280, P1281x, G1282, P1282, G2121, P2121, Q2121x, PQ2121x); version 2.10.6 or later for G2282x and P2282x; version 2.10.7 or later for Q2300x and PQ2300xb; version 3.9.10 or later for G2540xs, P2540xs, and FX2120; and version 3.10.6 or later for G2542x, P2542x, and P2542xh. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vigorswitch G2540Xs
View allPre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker
Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary
Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS
Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS co
Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers hold
Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbit
Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to
Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute
Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator
Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arb
Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute
Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple fir
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Null Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today