CVE-2026-71922

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch (affected versions not specified)

Description A pre-authentication null pointer dereference occurs in the 'setget.cgi' interface. This issue stems from missing validation when the pass field is absent. A remote attacker can send a crafted request to crash the service, resulting in a denial of service. A null pointer dereference is a condition where a program attempts to read or write to a memory address that is null, typically causing the application to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.