DrayTek Security Advisory Updates

1.     Command Injection and Buffer Overflow in DrayTek Vigor Access Points

DrayTek has found several security vulnerabilities in the VigorAP series, such as Command Injection and Buffer Overflow.

CVE IDENTIFIERS:  CVE-2026-71904 ~ CVE-2026-71914

While these conditions have been verified in affected firmware, there are no known methods to trigger or exploit them, and no practical attack path has been identified. Therefore, there is no current evidence that these issues can be exploited in real-world settings.

DrayTek has issued a firmware update for several Vigor Access Points to avoid possible problems. 

The updated firmware is available to download from our support page:

https://www.draytek.com.au/support/downloads/

Affected Models & Recommended Firmware

2.     Remote Code Execution and Buffer Overflow Vulnerabilities in VigorSwitches

DrayTek have published details of this security advisory on their website:

https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-july-2026.

Identified CVE IDs are:

• CVE-2026-52497
• CVE-2026-52498
• CVE-2026-52499
• CVE-2026-52500
• CVE-2026-52501
• CVE-2026-52502
• CVE-2026-52503

It is recommended to update the firmware on affected VigorSwitches indicated in the table below:

The firmware is available to download from our support page:

https://www.draytek.com.au/support/downloads/