CVE-2026-71932CWE-22path-traversal

CVE-2026-71932

Medium · published August 24, 2026

CVSS v3.1
4.9
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.01038 · 63.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-24T22:17Z
References (2)
https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/ · [email protected]https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-path-traversal-via-getsyslogfile · [email protected]
EPSS history
Timeline
  • 26 AUG 08:24Z
    EPSS moved — → 1%
    epss
  • 24 AUG 17:07Z
    DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile
    cvelistv5