Nixpkgs security tracker

Try the new UI
Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed
(no matching packages found)
Permalink CVE-2026-71919
8.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 3 weeks ago Activity log
  • Created & dismissed (no matching packages found) suggestion 3 weeks ago
DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

VigorSwitch G1280
  • <2.9.10
VigorSwitch G1282
  • <2.9.10
VigorSwitch G2100
  • <2.9.10
VigorSwitch G2121
  • <2.9.10
VigorSwitch P1280
  • <2.9.10
VigorSwitch P1282
  • <2.9.10
VigorSwitch P2100
  • <2.9.10
VigorSwitch P2121
  • <2.9.10
VigorSwitch FX2120
  • <3.9.10
VigorSwitch G2280x
  • <2.9.10
VigorSwitch G2282x
  • <2.10.6
VigorSwitch G2540x
  • <2.9.10
VigorSwitch G2542x
  • <3.10.6
VigorSwitch P1281x
  • <2.9.10
VigorSwitch P2280x
  • <2.9.10
VigorSwitch P2282x
  • <2.10.6
VigorSwitch P2540x
  • <2.9.10
VigorSwitch P2542x
  • <3.10.6
VigorSwitch PX2060
  • <2.9.10
VigorSwitch Q2121x
  • <2.9.10
VigorSwitch Q2200x
  • <2.9.10
VigorSwitch Q2300x
  • <2.10.7
VigorSwitch G2540xs
  • <3.9.10
VigorSwitch P2540xs
  • <3.9.10
VigorSwitch P2542xh
  • <3.10.6
VigorSwitch PQ2121x
  • <2.9.10
VigorSwitch PQ2200xb
  • <2.9.10
VigorSwitch PQ2300xb
  • <2.10.7