Path Traversal in Draytek Corporation Vigorswitch Fx2120
CVE-2026-71932
Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Draytek Corporation Vigorswitch Fx2120
- Draytek Corporation Vigorswitch G1280
- Draytek Corporation Vigorswitch G1282
- Draytek Corporation Vigorswitch G2100
- Draytek Corporation Vigorswitch G2121
- Draytek Corporation Vigorswitch G2280x
- Draytek Corporation Vigorswitch G2282x
- Draytek Corporation Vigorswitch G2540x
- Draytek Corporation Vigorswitch G2540xs
- Draytek Corporation Vigorswitch G2542x
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-71932?
- CVE-2026-71932 is a medium-severity vulnerability in Draytek Corporation Vigorswitch Fx2120, classified under Path Traversal. CVSS score: 4.9/10. Published 2026-08-24.
- How severe is CVE-2026-71932?
- Medium severity. CVSS v3 base score is 4.9 out of 10.