CVE-2026-71920 in VigorSwitch
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The identified security flaw resides within the formlogout function of multiple DrayTek VigorSwitch models, representing a classic null pointer dereference vulnerability. This specific type of error occurs when software attempts to access memory at an address that has not been properly allocated or initialized, typically resulting in a program crash or undefined behavior. In this particular instance, the root cause is traced directly to insufficient input validation within the web management interface's logout mechanism. Specifically, the application fails to verify whether the Cookie header present in incoming HTTP requests contains valid data before proceeding with string handling operations. When an attacker sends a crafted request where the Cookie header is either empty or entirely absent, the underlying code attempts to process this null value as if it were a standard string object. This logical oversight leads directly to a segmentation fault or similar critical failure within the web server service running on the device.
From an operational perspective, the primary impact of exploiting this vulnerability is a denial of service condition affecting the targeted network switch. Because the flaw triggers a crash in the process handling the logout functionality, the entire management interface becomes unresponsive until the service is manually restarted or the device is rebooted. This disruption prevents authorized administrators from accessing the web-based configuration tools, thereby hindering routine maintenance and security monitoring tasks. While the vulnerability itself does not allow for arbitrary code execution or direct data exfiltration, its availability as a denial of service vector poses a significant risk to network stability. An attacker who successfully exploits this flaw can effectively blindside administrative operations by rendering the management plane inaccessible during critical periods.
It is crucial to note that exploitation of this vulnerability requires valid administrative credentials for the device's web management interface. This constraint significantly limits the threat landscape, as it prevents remote unauthenticated attackers from triggering the crash. The attack vector is therefore classified as authenticated and network-accessible, meaning an adversary must first compromise or obtain legitimate access privileges to interact with the vulnerable endpoint. Despite this requirement, the vulnerability remains a serious concern for environments where insider threats exist or where administrative credentials may have been previously compromised through phishing, credential stuffing, or other means of account takeover.
In terms of industry classification standards, this vulnerability aligns closely with CWE-476, which defines null pointer dereference as a weakness resulting from the use of an invalid null reference. The attack technique employed to trigger this flaw corresponds to ATT&CK tactic T1529, specifically the system shutdown or reboot subtechnique, although in this context it manifests more accurately as service disruption rather than a full OS-level halt. To mitigate this risk, administrators should ensure that all DrayTek VigorSwitch models are updated to firmware versions where the formlogout function has been patched with proper null checks for incoming headers. Additionally, implementing strict access controls and multi-factor authentication on the management interface can reduce the likelihood of an attacker obtaining the necessary credentials to exploit this flaw even if it remains present in older firmware builds. Regular auditing of administrative accounts and limiting network exposure of the management plane further diminishes the attack surface associated with such authenticated vulnerabilities.