EUVD-2026-64981
GHSA-ppwv-q25g-vjpx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed VigorSwitch management interface
-
DeliverySend crafted HTTP request to setget.cgi omitting pass field
-
ExploitNull pointer dereference triggered in CGI handler
-
ExecutionManagement process crashes
-
ImpactSwitch web management interface unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required - the vulnerability is exploitable against the default web management interface (setget.cgi) of affected VigorSwitch models by any attacker who can send an HTTP request to the device management port. No authentication, no session, and no specific configuration state is needed beyond network reachability to the management interface. The key limiting factor is network reachability: switches with management interfaces restricted to a dedicated management VLAN or behind a firewall blocking untrusted HTTP/HTTPS access are not exploitable remotely. The impact ceiling is denial of service only - no confidentiality or integrity impact is achievable through this vulnerability per the CVSS 4.0 data. |
| Impact | The CVSS 4.0 base score of 8.7 accurately represents the exploitability profile: the attack is fully network-accessible, requires no authentication, and has no complexity barriers, making it trivial to automate or script. Impact is bounded to high availability loss against the switch management plane - confidentiality and integrity are unaffected per the CVSS vector, which is consistent with a null pointer dereference causing a process crash rather than memory disclosure or code execution. No EPSS score was provided in the available intelligence, and the vulnerability is not listed in CISA KEV, meaning no confirmed in-the-wild exploitation is known at time of analysis. However, the zero-barrier exploitation profile means any internet-exposed switch management interface is at immediate risk from opportunistic scanning. The primary real-world risk reduction factor is whether the management interface is network-isolated; organizations that expose switch web GUIs to untrusted segments should treat this as urgent regardless of KEV status. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP POST request to the setget.cgi endpoint with the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the pass field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.
RemediationAI
Apply the firmware updates identified in the official DrayTek security advisory at https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/. Exact patched firmware version numbers are not available in the provided input data and must be retrieved directly from the advisory before deployment. As a compensating control pending patching, restrict access to the switch web management interface (HTTP/HTTPS) using ACLs or upstream firewall rules to trusted administrative IP ranges only - this eliminates external reachability of setget.cgi and fully mitigates exploitation without requiring a firmware update. If remote web management is not operationally required, disabling it entirely is an effective mitigation. Note that ACL-based restrictions may affect NMS platforms or monitoring tools that poll switch management interfaces via HTTP; validate NMS connectivity after applying restrictions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 28 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in setget.cgi, a CGI handler on the HTTP/HTTPS management interface of DrayTek VigorSwitch managed switches used for device configuration operations. CWE-476 (Null Pointer Dereference) indicates the handler derives a pointer from the pass request field without first validating its presence; when the field is absent, the pointer is null and its dereference causes a process crash. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) confirms full network accessibility, no authentication requirement, and no additional attack conditions. CPE data from NVD/VulnCheck covers at least 10 confirmed models across the G, P, Q, PQ, and FX product sub-lines; VulnCheck tags expand the scope to approximately 28 distinct VigorSwitch models.
Know when Vigorswitch G2540Xs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Unauthenticated network-reachable crash with no confidentiality or integrity impact; unchanged scope as only the local management process is affected.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.
Executive ViewAI
DrayTek VigorSwitch managed switches are vulnerable to remote, unauthenticated denial-of-service attacks via the web management interface, affecting network infrastructure availability. The vulnerability can be exploited without authentication or user interaction, and no vendor patch is currently available. Organizations using these switches face immediate risk of management interface unavailability, potentially impairing network operations and administrative access.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable remote web management access and restrict management interface access to on-premises networks only; (2) Implement strict firewall rules to permit only trusted administrative IP addresses to reach management ports; (3) Deploy network segmentation to isolate management interfaces on dedicated administrative VLANs with restricted inter-VLAN routing; (4) Configure web application firewall rules to block requests to setget.cgi endpoint or require additional authentication headers; (5) Enable detailed logging and monitoring of management interface access attempts to detect exploitation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Vigorswitch G2540Xs
View allPre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker
Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary
Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS
Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS co
Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers hold
Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbit
Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to
Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute
Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator
Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arb
Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute
Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple fir
Exploit-DB