Alertas de Seguridad de la Información

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71934] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace functio…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71936] Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot functio…

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the sysreboot function. The vulnerability is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials fo…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71931] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade fu…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the tftp_upgrade function. The vulnerability is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for th…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71927] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71928] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice func…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71929] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto fun…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71930] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime functio…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71923] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set functi…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for th…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71924] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the …

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71925] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for t…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71926] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative cre…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71917] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web m…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71918] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid admini…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71919] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot funct…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credenti…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71912] Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. …

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71913] Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative creden…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71915] Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus func…

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credent…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71906] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. Th…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the devi…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71907] Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function.…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's we…

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

24/08/2026

[CVE-2026-71908] Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_te…

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administ…

nvdaltovulnerabilidad CVSS 7.2 NVD