CVE-2026-71920

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch (affected versions not specified)

Description A null pointer dereference occurs in the formlogout() function due to missing checks for an empty or absent Cookie header before string handling. A remote attacker with valid administrative credentials for the web management interface can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.