Buffer Overflow Vulnerability in DrayTek VigorSwitch Models

CVE-2026-71936

What is CVE-2026-71936?

Multiple models of DrayTek VigorSwitch are affected by a buffer overflow vulnerability linked to the sysreboot function. This issue arises from improper management of split valueN data, leading to unsafe concatenation into a fixed-size buffer. A remote attacker with valid administrative access to the web management interface can exploit this vulnerability by supplying specially crafted input. Such exploitation may result in a denial of service or even allow for the execution of arbitrary commands, raising significant security concerns for network environments utilizing these devices.

References