Buffer Overflow Vulnerability in DrayTek VigorSwitch Products
CVE-2026-71941

8.6HIGH

Key Information:

Vendor

Draytek Corporation

Status
Vigorswitch G2540xs
Vigorswitch P2540xs
Vigorswitch Fx2120
Vigorswitch G2282x
Vendor
CVE Published:
24 August 2026

What is CVE-2026-71941?

Multiple models of DrayTek VigorSwitch devices are susceptible to a buffer overflow vulnerability within the diag_logmail function. This issue arises when email addresses concatenated into a fixed-size buffer exceed its allocated space. A remote attacker could exploit this vulnerability by sending specially crafted input, leading to a denial of service condition or potentially executing arbitrary commands. Successful exploitation necessitates valid administrative credentials for the web management interface of the device.

Affected Version(s)

VigorSwitch FX2120 0 < 3.9.10

VigorSwitch G1280 0 < 2.9.10

VigorSwitch G1282 0 < 2.9.10

References

https://www.draytek.com/about/security-advisory/multiple-...
vendor-advisory
https://www.vulncheck.com/advisories/draytek-vigorswitch-...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jincheng Wang (@winmt)
Le Yu (Nanjing University of Posts and Telecommunications)
Xiapu Luo (The Hong Kong Polytechnic University)
.