DrayTek Corporation Vigorswitch PQ2300XB vulnerabilities

29 CVEs affecting DrayTek Corporation Vigorswitch PQ2300XB, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71943, published 2026-08-24.

More from DrayTek Corporation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-71921, published 2026-08-24. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field…
• CVE-2026-71943, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields…
• CVE-2026-71930, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before…
• CVE-2026-71929, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields…
• CVE-2026-71928, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields…
• CVE-2026-71927, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields…
• CVE-2026-71926, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and…
• CVE-2026-71925, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields…
• CVE-2026-71924, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before…
• CVE-2026-71923, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields…

Latest

• CVE-2026-71942, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a…
• CVE-2026-71941, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a…
• CVE-2026-71940, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer…
• CVE-2026-71939, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer…
• CVE-2026-71938, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switch_lan_gvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized…
• CVE-2026-71937, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time,…
• CVE-2026-71936, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size…
• CVE-2026-71935, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the webBackupAction function. The vulnerability is caused by repeated string concatenation of the pathN, valueN, key,…
• CVE-2026-71934, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields…