CVE-2026-71932: DrayTek Corporation Vigorswitch FX2120

Medium severity, CVSS 4.9. EPSS: 1% chance of exploitation in the next 30 days.

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

• DrayTek Corporation Vigorswitch FX2120: before 3.9.10 (fixed in 3.9.10)
• DrayTek Corporation Vigorswitch g1280: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g1282: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g2100: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g2121: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g2280x: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g2282x: before 2.10.6 (fixed in 2.10.6)
• DrayTek Corporation Vigorswitch g2540x: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch g2540xs: before 3.9.10 (fixed in 3.9.10)
• DrayTek Corporation Vigorswitch g2542x: before 3.10.6 (fixed in 3.10.6)
• DrayTek Corporation Vigorswitch p1280: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p1281x: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p1282: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p2100: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p2121: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p2280x: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p2282x: before 2.10.6 (fixed in 2.10.6)
• DrayTek Corporation Vigorswitch p2540x: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch p2540xs: before 3.9.10 (fixed in 3.9.10)
• DrayTek Corporation Vigorswitch p2542x: before 3.10.6 (fixed in 3.10.6)
• DrayTek Corporation Vigorswitch p2542xh: before 3.10.6 (fixed in 3.10.6)
• DrayTek Corporation Vigorswitch PQ2121X: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch PQ2200XB: before 2.9.10 (fixed in 2.9.10)
• DrayTek Corporation Vigorswitch PQ2300XB: before 2.10.7 (fixed in 2.10.7)
• DrayTek Corporation Vigorswitch PX2060: before 2.9.10 (fixed in 2.9.10)
• and 3 more

Published 2026-08-24. Last modified 2026-08-26.