Vigorswitch G2540Xs

Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary OS commands with root privileges by supplying crafted username or password values. At least ten VigorSwitch models are confirmed affected via CPE data, with the full tag list extending coverage to approximately 28 model variants. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability class (CWE-78) and the root-level impact make it high priority for any DrayTek VigorSwitch deployment where administrative credentials may be compromised or shared.

Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.

Buffer overflow in DrayTek VigorSwitch's diag_logmail function allows authenticated administrators to cause denial of service or potentially execute arbitrary commands on affected network switches. The flaw, reported by VulnCheck and acknowledged in DrayTek's August 2026 security advisory, affects a broad range of VigorSwitch models spanning SMB and enterprise product lines. Exploitation requires valid administrative credentials, limiting opportunistic attack surface, but a compromised or rogue admin account can fully compromise device confidentiality, integrity, and availability. No public exploit code and no CISA KEV listing identified at time of analysis.

Buffer overflow in DrayTek VigorSwitch web management interface allows authenticated remote administrators to cause denial of service or potentially execute arbitrary commands on affected managed switches. The flaw resides in the acl_general_setup Edit ACE function, where the name field is copied into a fixed-size stack buffer without length validation (CWE-120). No public exploit code has been identified at time of analysis, and exploitation is gated behind valid administrative credentials, meaningfully reducing the attack surface compared to unauthenticated network flaws.

Buffer overflow in DrayTek VigorSwitch's ACL configuration function exposes authenticated administrators to denial of service or potential arbitrary command execution via the device's web management interface. The root cause - an unbounded strcpy-style copy of a user-supplied name field into a fixed-size stack or heap buffer inside acl_general_setup's Add ACE handler - is a classic CWE-120 defect reachable over the network from any host with management-plane access. Exploitation requires valid administrative credentials (CVSS PR:H), substantially limiting the attack surface; no public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Buffer overflow in DrayTek VigorSwitch's switch_lan_gvrp function exposes multiple managed switch models to denial of service or potential arbitrary command execution from remote, authenticated attackers. The flaw stems from unsafe copying of a user-supplied portList field into an undersized stack or heap buffer within the GVRP handling code - a classic CWE-120 defect reachable via the device's web management interface. No public exploit code and no CISA KEV listing have been identified at time of analysis, and exploitation is gated behind valid administrative credentials, which meaningfully constrains real-world attacker opportunity.

Buffer overflow in DrayTek VigorSwitch's PoE schedule profile function allows authenticated remote administrators to cause denial of service or execute arbitrary commands on affected network switches. The flaw spans at least 10 CPE-confirmed models and an even wider set per VulnCheck tags, covering much of the VigorSwitch product line. No public exploit code and no CISA KEV listing have been identified at time of analysis, but DrayTek has published a security advisory acknowledging the issue.

Buffer overflow in the sysreboot function of multiple DrayTek VigorSwitch managed switch models allows authenticated remote attackers to cause denial of service or execute arbitrary commands. The root cause (CWE-120) is unsafe concatenation of split valueN attacker-controlled data into a fixed-size buffer in the device's web management firmware, exploitable over the network by any party holding valid administrative credentials. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stack buffer overflow in DrayTek VigorSwitch's webBackupAction function enables authenticated administrators to trigger denial of service or arbitrary code execution by submitting crafted HTTP requests with excessively long pathN, valueN, key, and option parameters. Exploitation is gated behind valid administrative credentials (CVSS PR:H), limiting direct internet exposure but creating meaningful risk via compromised admin accounts or insider threats. No public exploit identified at time of analysis and no CISA KEV listing, though the CWE-120 root cause class is well-understood and device-accessible researchers could feasibly develop working exploits.

Buffer overflow in DrayTek VigorSwitch's pingtrace diagnostic function allows authenticated remote attackers to cause denial of service or achieve arbitrary command execution across a broad range of VigorSwitch hardware models. The flaw arises from absent length validation when user-supplied host, count, and interval parameters are concatenated into a statically allocated buffer in the web management firmware. No public exploit is identified at time of analysis, and exploitation is gated behind valid administrative credentials, but the severity of achievable impact - full device compromise - warrants prompt patching on any network where VigorSwitch units are deployed.

Unauthorized operation vulnerabilities in multiple DrayTek VigorSwitch managed switch models allow unauthenticated remote attackers to manipulate device state - including modifying configuration, restarting services, overwriting startup configuration, and clearing audit logs - without any authentication. Affecting at least 28 named VigorSwitch models across the G, P, PQ, Q, and FX series, the root cause is missing authorization checks in multiple syslog-related HTTP handler functions (CWE-862). The CVSS 4.0 score of 8.8 with AV:N/PR:N/UI:N confirms the full attack surface is exposed to any network-reachable attacker, with no public exploit or CISA KEV listing identified at time of analysis.

Directory traversal in DrayTek VigorSwitch's getSyslogFile web management function exposes arbitrary device filesystem files to authenticated administrators who supply crafted path traversal sequences in the option parameter. Twenty-eight VigorSwitch managed-switch models across the G, P, Q, PQ, FX, and PX product lines are confirmed affected, with firmware versions fixed at 2.9.10, 2.10.6, 2.10.7, 3.9.10, and 3.10.6 depending on the model. No public exploit code has been identified at time of analysis and this CVE is absent from the CISA KEV catalog, but vendor-released patches are available and should be prioritized given the breadth of affected hardware.

Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute arbitrary OS commands with root privileges. At least 28 VigorSwitch models across DrayTek's managed switch lineup are affected, spanning both Gigabit and PoE/fiber variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 4.0 score of 8.6 reflects high impact across confidentiality, integrity, and availability once administrative access is leveraged.

Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS commands with root privileges across at least ten confirmed models, with tags suggesting up to 28 additional affected variants. The flaw stems from insufficient input sanitization of username and password fields before shell execution, a classic CWE-78 pattern. No public exploit code or CISA KEV listing has been identified at time of analysis; exploitation is gated behind valid administrative credentials, per the CVSS PR:H rating and vendor description.

Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS commands with root privileges through the setDevProto function's unsanitized username and password fields. At least 10 CPE-confirmed models are affected, with vendor tags suggesting a broader footprint of approximately 28 VigorSwitch variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, DrayTek published a security advisory in August 2026 acknowledging the vulnerability and the authentication prerequisite of valid admin credentials is the primary constraint on real-world exploitation.

Command injection in DrayTek VigorSwitch firmware's fdftDevice function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted input in the username or password fields of the web management interface. Approximately 28 VigorSwitch models across the G, P, Q, and PQ series are affected, confirmed by both VulnCheck reporting and a DrayTek vendor advisory published August 2026. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Command injection in DrayTek VigorSwitch's rebDevice function allows authenticated remote attackers with valid administrative credentials to execute arbitrary OS commands with root privileges by submitting crafted username or password values through the web management interface. At least 10 VigorSwitch models are confirmed affected per CPE data, with tags suggesting coverage across roughly 28 distinct models spanning the G, P, Q, PQ, and FX product lines. No public exploit or CISA KEV listing has been identified at time of analysis, though the advisory originates from a VulnCheck disclosure coordinated with a DrayTek security bulletin dated August 2026.

Command injection via the setDevice function affects multiple DrayTek VigorSwitch managed switch models, allowing an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying unsanitized input in the username, password, or location fields. The breadth of affected hardware - at least 28 distinct VigorSwitch SKUs spanning G, P, PQ, Q, and FX series - substantially widens the organizational exposure surface. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible management interface and high-impact outcome make this a meaningful post-compromise escalation path.

Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers holding valid administrative credentials to execute arbitrary OS commands with root privileges. The flaw (CWE-78) arises from the web management interface failing to sanitize username and password fields before incorporating them into system command execution. DrayTek published a security advisory in August 2026 covering a broad range of VigorSwitch models; no public exploit code or CISA KEV listing has been identified at time of analysis.

Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted values in the username or password fields of the web management interface. At least 28 VigorSwitch models across the G, P, Q, PQ, and FX series are confirmed affected by the DrayTek August 2026 security advisory and VulnCheck reporting. No public exploit code has been identified at time of analysis, but the breadth of affected models and full root-level impact make this a patch-priority item for any organization operating DrayTek managed switching infrastructure.

Command injection in DrayTek VigorSwitch managed switches allows an authenticated remote attacker holding administrative credentials to execute arbitrary OS commands with root privileges by supplying crafted input to the auth_set function via the web management interface. At least 28 distinct VigorSwitch model lines are affected across DrayTek's G, P, PQ, Q, and FX series, with the vulnerability reported by VulnCheck and acknowledged via a DrayTek security advisory in August 2026. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis; the CVSS 4.0 score of 8.6 with PR:H accurately reflects that valid administrative credentials are a prerequisite, materially limiting opportunistic mass exploitation.

Denial of service in multiple DrayTek VigorSwitch managed switch models can be triggered remotely without authentication via the setget.cgi web management interface. The root cause is a null pointer dereference (CWE-476) triggered when the `pass` field is absent from a crafted request, crashing the CGI service. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N) confirms trivial remote exploitability with no prerequisites; no public exploit or CISA KEV listing has been identified at time of analysis.

Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it.

Null pointer dereference in DrayTek VigorSwitch's formlogout web management function allows authenticated remote administrators to crash the management service, causing a denial of service across 28+ switch models spanning the G, P, Q, FX, and PX product lines. The flaw stems from absent validation of an empty or missing Cookie header before string handling in the formlogout handler, and is patched in firmware versions released under DrayTek's August 2026 security advisory. No public exploit code or CISA KEV listing is referenced in the available data.

Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to execute arbitrary OS commands with root privileges via the web management interface. The flaw resides in the sysreboot function, which fails to sanitize the config, act, pathN, and valueN parameters before passing them to OS command execution, per CWE-78. No public exploit or CISA KEV listing exists at time of analysis, but the VulnCheck and DrayTek advisories confirm the vulnerability across at least 28 VigorSwitch SKUs.

Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute arbitrary OS commands with root privileges across more than 25 managed switch models. Insufficient input sanitization of the `option`, `key`, `pw_encode`, `pathN`, and `valueN` parameters enables shell metacharacter injection, resulting in full device compromise. No public exploit has been identified at time of analysis; the administrative credential prerequisite is the primary barrier against opportunistic exploitation.

Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator to execute arbitrary OS commands with root privileges by submitting a crafted host field value. Twenty-eight distinct VigorSwitch models across the G, P, Q, PQ, FX, and PX series are affected, with patched firmware releases varying by model family (2.9.10, 2.10.6, 2.10.7, and 3.10.6). No public exploit has been identified at time of analysis and CISA has not listed this in KEV; exploitation is constrained by the mandatory administrative credential requirement confirmed by the CVSS PR:H metric.

Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple firmware branches, allowing an authenticated administrator to execute arbitrary OS commands with root privileges on the device. The root cause is incomplete sanitization of shell metacharacters - specifically backticks, newline characters, and single quotes - in a parameter field processed by the web management interface. Exploitation requires valid administrative credentials; patch available per DrayTek's August 2026 security advisory. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arbitrary OS commands as root by submitting crafted values in the usescript, usefile, or option fields. At least 28 distinct VigorSwitch models across multiple firmware branches are confirmed affected per EUVD-2026-64974 and vendor advisory. Vendor-released patches are available; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.