Buffer Overflow Vulnerability in DrayTek VigorSwitch Models
CVE-2026-71940
8.6HIGH
Key Information:
- Vendor
Draytek Corporation
- Vendor
- CVE Published:
- 24 August 2026
What is CVE-2026-71940?
Multiple models of DrayTek VigorSwitch are vulnerable to a buffer overflow that arises during the acl_general_setup Edit ACE function. This vulnerability occurs due to the inadequacy of length validation when copying the name field into a fixed-size buffer. A remote attacker could potentially exploit this flaw, given valid administrative credentials to the web management interface, leading to denial of service or executing arbitrary commands on the affected device.
Affected Version(s)
VigorSwitch FX2120 0 < 3.9.10
VigorSwitch G1280 0 < 2.9.10
VigorSwitch G1282 0 < 2.9.10
References
CVSS V4
Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jincheng Wang (@winmt)
Le Yu (Nanjing University of Posts and Telecommunications)
Xiapu Luo (The Hong Kong Polytechnic University)