Buffer Overflow Vulnerability in DrayTek VigorSwitch Models

CVE-2026-71942

What is CVE-2026-71942?

Multiple DrayTek VigorSwitch models exhibit a vulnerability in the mail_mailalert function, where concatenating multiple smtpReceiver email addresses into a fixed-size buffer without adequate buffer size checks can lead to a buffer overflow. This issue can be exploited by remote attackers with valid administrative credentials, resulting in potential denial of service or arbitrary code execution. Ensuring proper safeguards when managing email addresses is crucial to mitigate such vulnerabilities.

References