The vulnerability arises from missing authorization checks in multiple syslog functions on DrayTek VigorSwitch devices. A remote attacker can craft requests that trigger these functions to alter configuration settings, restart services, save startup configuration, or clear system logs. These capabilities effectively allow an attacker to modify the device state and disrupt network operations, potentially facilitating broader attacks within the network.

Affected devices include a range of DrayTek VigorSwitch models such as FX2120, G1280, G1282, G2100, G2121, G2280x, G2282x, G2540x, G2540xs, G2542x, P1280, P1281x, P1282, P2100, P2121, P2280x, P2282x, P2540x, P2540xs, P2542x, P2542xh, PQ2121x, PQ2200xb, PQ2300xb, PX2060, Q2121x, Q2200x, and Q2300x.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote, as an attacker only needs to send crafted syslog requests without authentication to trigger the functions. Given the lack of authorization checks, the likelihood of exploitation is significant in environments where syslog traffic can reach the device unfiltered.