CVE-2026-71922: DrayTek VigorSwitch Null Pointer DoS Flaw

CVE-2026-71922 Overview

CVE-2026-71922 is a pre-authentication null pointer dereference vulnerability affecting multiple DrayTek VigorSwitch models. The flaw resides in the setget.cgi web interface and stems from missing input validation when the pass field is absent from a request. A remote, unauthenticated attacker can send a crafted HTTP request to trigger the dereference and crash the management service. The result is a denial of service against the switch management plane. The vulnerability is tracked under CWE-476: NULL Pointer Dereference.

Critical Impact
Unauthenticated remote attackers can crash the management service on affected DrayTek VigorSwitch devices, disrupting network administration and monitoring.

Affected Products

Multiple DrayTek VigorSwitch models (see vendor advisory for the full model list)
Devices exposing the setget.cgi management endpoint
Firmware versions listed in the DrayTek August 2026 advisory

Discovery Timeline

2026-08-24 - CVE-2026-71922 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71922

Vulnerability Analysis

The vulnerability exists in the setget.cgi handler exposed by the VigorSwitch web management interface. The handler processes user-supplied form parameters without verifying that all required fields are present. When a request omits the pass field, the handler references a pointer that was never initialized. Dereferencing that null pointer terminates the process serving the management interface.

Because the handler is reachable prior to authentication, no valid credentials or session token are required. An attacker with network reachability to the management interface can trigger the crash repeatedly. Successful exploitation impacts availability of the device management plane but does not by itself yield code execution or data disclosure.

Root Cause

The root cause is missing input validation on the pass parameter within setget.cgi. The code path assumes the parameter is always present and proceeds to operate on the associated pointer without a null check. This pattern is characteristic of CWE-476 defects in embedded web management stacks.

Attack Vector

Exploitation requires only network access to the switch management interface, typically HTTP or HTTPS on the LAN or a management VLAN. The attacker sends a crafted request to setget.cgi that intentionally omits the pass field. No authentication, user interaction, or prior foothold is required. Repeated requests can be used to keep the management service in a crash-restart loop, denying administrators access to the device.

See the DrayTek Security Advisory and the VulnCheck Advisory on DrayTek Vulnerabilities for additional technical context.

Detection Methods for CVE-2026-71922

Indicators of Compromise

Unexpected restarts or crash logs from the VigorSwitch HTTP management daemon
HTTP requests to /setget.cgi from untrusted sources that omit the pass parameter
Repeated management-interface unavailability without corresponding administrator activity
SNMP or syslog events indicating web service termination on affected switches

Detection Strategies

Inspect web server and application logs for POST or GET requests to setget.cgi with malformed or missing form fields
Correlate management-plane restarts with inbound HTTP traffic to identify probing patterns
Deploy network intrusion detection signatures that flag requests to setget.cgi missing the pass parameter

Monitoring Recommendations

Forward switch syslog and crash telemetry to a centralized SIEM for correlation
Alert on repeated 5xx responses or connection resets from switch management IPs
Baseline normal administrative access patterns and flag deviations against source, frequency, and payload shape

How to Mitigate CVE-2026-71922

Immediate Actions Required

Restrict access to the VigorSwitch web management interface to trusted management networks or jump hosts
Disable remote WAN-side management on affected devices until firmware is updated
Apply the firmware update referenced in the DrayTek Security Advisory once available for your model
Audit exposed switch management interfaces using internal asset inventory and external attack-surface data

Patch Information

DrayTek published a security advisory covering multiple vulnerabilities in the VigorSwitch series in August 2026. Administrators should identify the fixed firmware version for their specific model in the DrayTek Security Advisory and schedule an upgrade. VulnCheck also tracks affected models and versions in its advisory.

Workarounds

Place switch management interfaces on an isolated out-of-band management VLAN
Enforce ACLs on the management interface to permit only known administrator IP addresses
Terminate untrusted HTTP access to setget.cgi at an upstream reverse proxy or firewall until patched
Monitor for and automatically restart the management service if crash loops are observed, while access controls remediate the root cause

bash

# Example ACL restricting management access to a trusted subnet
# Adjust interface, ACL name, and admin subnet to your environment
ip access-list extended MGMT-ACL
  permit tcp 10.10.0.0 0.0.0.255 any eq 80
  permit tcp 10.10.0.0 0.0.0.255 any eq 443
  deny   tcp any any eq 80
  deny   tcp any any eq 443
  permit ip any any
interface vlan 99
  ip access-group MGMT-ACL in