CVE-2026-71920 Overview
CVE-2026-71920 is a null pointer dereference vulnerability [CWE-476] affecting multiple DrayTek VigorSwitch models. The flaw resides in the formlogout function of the device's web management interface. The function fails to validate whether the Cookie HTTP header is present or empty before performing string operations on it. An authenticated attacker with administrative credentials can send a crafted logout request to crash the management service. Successful exploitation results in a denial of service against the switch's web administration.
Critical Impact
A remote attacker with administrative credentials can crash the web management service by sending a request to formlogout without a valid Cookie header, disrupting device administration.
Affected Products
- DrayTek VigorSwitch series (multiple models)
- Web management interface component containing the formlogout handler
- See the DrayTek Security Advisory for the full affected model list
Discovery Timeline
- 2026-08-24 - CVE-2026-71920 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-71920
Vulnerability Analysis
The vulnerability is a null pointer dereference in the formlogout handler exposed by the VigorSwitch web management interface. The handler retrieves the Cookie header from the incoming HTTP request and passes the resulting pointer into string handling routines. When the Cookie header is absent or empty, the retrieval returns a null pointer. Subsequent string operations dereference that pointer and crash the process serving the web interface.
Exploitation requires valid administrative credentials, which raises the required privilege but does not prevent abuse by insider threats, credential-theft scenarios, or attackers who obtained credentials through phishing or reuse. The result is a denial of service against the management plane rather than compromise of confidentiality or integrity.
Root Cause
The root cause is missing input validation before pointer use. The formlogout code path does not check whether the pointer returned for the Cookie header is non-null before invoking string functions on it. This is a standard [CWE-476] pattern where an untrusted absence of input causes a fatal dereference.
Attack Vector
The attack vector is network-based against the switch's HTTP or HTTPS management interface. An authenticated administrator sends a crafted request to the formlogout endpoint with no Cookie header, or with an empty value. The web service dereferences the null pointer and terminates. Repeated requests sustain the denial of service.
No verified exploit code is publicly available. See the VulnCheck Advisory on DrayTek for additional technical context.
Detection Methods for CVE-2026-71920
Indicators of Compromise
- HTTP requests to /formlogout on VigorSwitch management interfaces that omit the Cookie header or send an empty Cookie value
- Repeated unexpected restarts of the switch web administration daemon
- Loss of availability of the VigorSwitch web UI while other switching functions continue to operate
Detection Strategies
- Inspect HTTP access logs on management interfaces for requests to formlogout lacking a session cookie
- Alert on authenticated administrative sessions that generate anomalous logout traffic patterns or repeated formlogout calls in short intervals
- Correlate management-plane HTTP request telemetry with process crash or reboot events on the switch
Monitoring Recommendations
- Forward switch syslog and management-plane access logs to a centralized SIEM for baseline and anomaly analysis
- Monitor uptime and web-service availability metrics for VigorSwitch devices to detect service crashes quickly
- Track administrative account authentication events and flag credential use from unexpected source IP ranges
How to Mitigate CVE-2026-71920
Immediate Actions Required
- Restrict access to the VigorSwitch web management interface to trusted management VLANs and administrative jump hosts
- Rotate administrative credentials and enforce strong, unique passwords on all VigorSwitch devices
- Apply the firmware update published by DrayTek for affected VigorSwitch models as soon as it is available in your environment
Patch Information
DrayTek has published fixed firmware for the affected VigorSwitch models. Refer to the DrayTek Security Advisory for the exact model list and firmware versions that address CVE-2026-71920, and follow the vendor's upgrade procedure for each device.
Workarounds
- Block inbound access to the switch web management interface from user networks and the internet using ACLs or firewall rules
- Disable the HTTP or HTTPS management interface on switches administered exclusively via CLI, SSH, or SNMP
- Limit the number of administrative accounts and audit their use to reduce the pool of credentials that could trigger the vulnerability
# Configuration example: restrict management interface access at the network edge
# Replace with your management subnet and switch IP
iptables -A FORWARD -s 10.10.0.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
