CVE-2026-71920: DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout
Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
DrayTek VigorSwitch devices with an accessible web management interface are exposed if an attacker has valid administrative credentials. The issue can be triggered remotely through a crafted request.
What does an attacker need to exploit it?
The attacker needs network access to the device's web management interface and valid administrative credentials. No user interaction is required.
What request condition triggers the crash?
The vulnerable formlogout function mishandles an empty or absent Cookie header before performing string handling. A crafted request using that condition can crash the service.
What is the impact of successful exploitation?
Successful exploitation causes a null pointer dereference that can crash the affected service, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.