Missing Authorization in DrayTek Corp. products - CVE-2026-71933

Vulnerability identifier: #VU151547

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-71933

CWE-ID: CWE-862

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to missing authorization in multiple syslog functions. A remote attacker can send specially crafted requests to modify configuration, restart services, save startup configuration or clear logs.

VigorSwitch P2540x
VigorSwitch G2540x
VigorSwitch G1280
VigorSwitch P1280
VigorSwitch G1282
VigorSwitch P2100
VigorSwitch G2100
VigorSwitch PQ2200xb
VigorSwitch Q2200x
VigorSwitch P2280x
VigorSwitch G2280x
VigorSwitch Q2121x
VigorSwitch PQ2121x
VigorSwitch P2121
VigorSwitch G2121
VigorSwitch P1282
VigorSwitch P1281x
VigorSwitch PX2060
VigorSwitch PQ2300xb
VigorSwitch Q2300x
VigorSwitch P2282x
VigorSwitch G2282x
VigorSwitch G2540xs
VigorSwitch EX2120
VigorSwitch P2540xs
VigorSwitch P2542xh
VigorSwitch P2542x
VigorSwitch G2542x

Install updates from vendor's website.

VigorSwitch P2540x - update to 2.9.10
VigorSwitch G2540x - update to 2.9.10
VigorSwitch G1280 - update to 2.9.10
VigorSwitch P1280 - update to 2.9.10
VigorSwitch G1282 - update to 2.9.12
VigorSwitch P2100 - update to 2.9.12
VigorSwitch G2100 - update to 2.9.12
VigorSwitch PQ2200xb - update to 2.9.12
VigorSwitch Q2200x - update to 2.9.12
VigorSwitch P2280x - update to 2.9.12
VigorSwitch G2280x - update to 2.9.12
VigorSwitch Q2121x - update to 2.9.12
VigorSwitch PQ2121x - update to 2.9.12
VigorSwitch P2121 - update to 2.9.12
VigorSwitch G2121 - update to 2.9.12
VigorSwitch P1282 - update to 2.9.12
VigorSwitch P1281x - update to 2.9.12
VigorSwitch PX2060 - update to 2.9.12
VigorSwitch PQ2300xb - update to 2.10.9
VigorSwitch Q2300x - update to 2.10.9
VigorSwitch P2282x - update to 2.10.9
VigorSwitch G2282x - update to 2.10.9
VigorSwitch G2540xs - update to 3.9.12
VigorSwitch EX2120 - update to 3.9.12
VigorSwitch P2540xs - update to 3.9.12
VigorSwitch P2542xh - update to 3.10.9
VigorSwitch P2542x - update to 3.10.9
VigorSwitch G2542x - update to 3.10.9

• https://www.draytek.com/about/security-advisory/security-update-for-vigorswitch-series-september-2026

• Multiple vulnerabilities in DrayTek VigorSwitch Series