Security Advisory: Security Updates for VigorSwitch Series DSA-2026-004

Number: DSA-2026-004

Updated firmware is now available for supported VigorSwitch models, incorporating the latest security updates and firmware enhancements. Customers are encouraged to keep their devices up to date with the appropriate firmware versions.

On June 1, several potential security vulnerabilities were identified within the DrayTek VigorSwitch mainfunction.cgi component, including Command Injection, Null Pointer Dereference, Directory Traversal and Buffer Overflow. 

Although these conditions have been confirmed to exist in the affected code, there are currently no known or documented methods to trigger or exploit them, and no practical attack path has been identified. Consequently, there is no evidence at this time that the reported issues are exploitable in deployed environments. If a viable exploitation method were identified, it would likely require an attacker to possess valid administrative credentials and be able to authenticate to the switch’s web management interface.

Should a method be identified that allows these conditions to be reached and successfully exploited, they could potentially result in arbitrary code execution on an affected appliance. However, the feasibility of such exploitation has not been demonstrated. DrayTek Corp has addressed these findings in updated firmware releases and recommends that customers upgrade to the versions listed below as a preventive security measure.

The firmware updates are released for the following models. No other models are affected. Please click here to download and upgrade the firmware for your specific model as soon as possible to ensure your system remains up to date. These updates supplement the earlier updates reported on DSA-2026-003