CVE-2026-71922 in VigorSwitch G2540xs
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The identified security flaw resides within the web management interface of multiple DrayTek VigorSwitch models, specifically affecting the setget.cgi application component. This vulnerability is classified as a pre-authentication null pointer dereference, which represents a critical severity issue due to its accessibility without requiring valid user credentials. The root cause lies in insufficient input validation performed by the server-side script when processing HTTP requests directed at this interface. Specifically, the system fails to adequately check for the presence or validity of the pass field within incoming request parameters before attempting to access memory locations associated with that data structure.
From a technical perspective, the vulnerability exploits a logic error where the application assumes the existence of specific input fields without verifying their actual transmission by the client. When an attacker crafts a malicious HTTP request that omits the expected pass parameter or sends it in a malformed state, the underlying C code attempts to dereference a null pointer. This operation violates standard memory management protocols and triggers a segmentation fault within the web server process running on the network switch. The lack of proper exception handling for such edge cases allows an external actor to force the application into an unrecoverable error state.
The operational impact of this vulnerability is primarily centered around denial of service conditions. By repeatedly sending crafted requests that trigger the null pointer dereference, a remote attacker can cause the web management interface to crash or become unresponsive. This disruption prevents authorized administrators from accessing the device for configuration and monitoring purposes. In some deployment scenarios, if the affected process does not automatically restart or is tied to critical system functions, the instability could potentially lead to broader service interruptions on the network segment managed by the switch. The ability to exploit this flaw without authentication significantly lowers the barrier for entry, allowing any internet-facing device with this software version to be targeted.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-476, which describes a NULL Pointer Dereference condition where an application dereferences a pointer that it expects to point to valid memory but does not perform proper validation of the pointer's value beforehand. Furthermore, from a tactical perspective related to the MITRE ATT&CK framework, this exploit technique falls under Initial Access and Impact categories, specifically leveraging unauthenticated API endpoints to disrupt service availability. Attackers often utilize such vulnerabilities as part of broader campaigns aimed at disrupting critical infrastructure or creating noise during more complex intrusion attempts.
Mitigation strategies should focus on immediate patching by the vendor if an updated firmware version is available that addresses the input validation logic in setget.cgi. In environments where updating is not immediately feasible, network-level controls can provide temporary relief. Implementing strict firewall rules to restrict access to the switch's management interface exclusively from trusted administrative IP ranges reduces the attack surface significantly. Additionally, disabling unnecessary web services or ports on devices that do not require remote HTTP/HTTPS access further limits exposure. Security teams should also monitor for anomalous traffic patterns targeting network device interfaces, as repeated failed requests or unusual payload structures may indicate active exploitation attempts of this null pointer dereference flaw.