Answer in brief
CVE-2026-71922 records a High severity (CVSS 7.5) vulnerability in DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi. The current sources do not mark it as known exploited. The current feed maps DrayTek Corporation/VigorSwitch FX2120 (generic), DrayTek Corporation/VigorSwitch G1280 (generic), DrayTek Corporation/VigorSwitch G1282 (generic), DrayTek Corporation/VigorSwitch G2100 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps DrayTek Corporation/VigorSwitch FX2120 (generic), DrayTek Corporation/VigorSwitch G1280 (generic), DrayTek Corporation/VigorSwitch G1282 (generic), DrayTek Corporation/VigorSwitch G2100 (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| DrayTek Corporation/VigorSwitch FX2120generic | >=0 <3.9.10 | 3.9.10 |
| DrayTek Corporation/VigorSwitch G1280generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G1282generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G2100generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G2121generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G2280xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G2282xgeneric | >=0 <2.10.6 | 2.10.6 |
| DrayTek Corporation/VigorSwitch G2540xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch G2540xsgeneric | >=0 <3.9.10 | 3.9.10 |
| DrayTek Corporation/VigorSwitch G2542xgeneric | >=0 <3.10.6 | 3.10.6 |
| DrayTek Corporation/VigorSwitch P1280generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P1281xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P1282generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P2100generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P2121generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P2280xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P2282xgeneric | >=0 <2.10.6 | 2.10.6 |
| DrayTek Corporation/VigorSwitch P2540xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch P2540xsgeneric | >=0 <3.9.10 | 3.9.10 |
| DrayTek Corporation/VigorSwitch P2542xgeneric | >=0 <3.10.6 | 3.10.6 |
| DrayTek Corporation/VigorSwitch P2542xhgeneric | >=0 <3.10.6 | 3.10.6 |
| DrayTek Corporation/VigorSwitch PQ2121xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch PQ2200xbgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch PQ2300xbgeneric | >=0 <2.10.7 | 2.10.7 |
| DrayTek Corporation/VigorSwitch PX2060generic | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch Q2121xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch Q2200xgeneric | >=0 <2.9.10 | 2.9.10 |
| DrayTek Corporation/VigorSwitch Q2300xgeneric | >=0 <2.10.7 | 2.10.7 |
Published upstream
Aug 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 26, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 24, 2026
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.
Quoted source text, attributed separately from HOL analysis.