CVE-2026-71937: DrayTek VigorSwitch Buffer Overflow Flaw

CVE-2026-71937 Overview

CVE-2026-71937 is a buffer overflow vulnerability affecting multiple DrayTek VigorSwitch models. The flaw resides in the poe_schedule_profile function within the device's web management interface. Repeated concatenation of user-supplied schedule fields into small fixed-size buffers occurs without proper length validation. An authenticated remote attacker with administrative credentials can trigger the overflow through crafted input. Successful exploitation can cause denial of service or potentially lead to arbitrary command execution on the affected switch. The vulnerability is classified under CWE-120 (Classic Buffer Overflow).

Critical Impact

An authenticated attacker can corrupt memory in the switch management plane, disrupt Power over Ethernet (PoE) scheduling services, and potentially execute arbitrary commands on network infrastructure devices.

Affected Products

• Multiple DrayTek VigorSwitch models (see the DrayTek Security Advisory for the full model list)
• DrayTek VigorSwitch web management interface
• PoE scheduling configuration component (poe_schedule_profile)

Discovery Timeline

• 2026-08-24 - CVE-2026-71937 published to NVD
• 2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71937

Vulnerability Analysis

The vulnerability affects the PoE schedule profile handler within the VigorSwitch web management interface. This handler accepts several user-controlled fields that define scheduling behavior for Power over Ethernet ports. The affected fields include start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration.

The function concatenates these fields into fixed-size stack or heap buffers using unchecked string operations. Because no length validation occurs before or during concatenation, oversized inputs overwrite adjacent memory. Depending on the affected model and firmware layout, this corruption can crash the management service or divert control flow.

Exploitation requires valid administrative credentials for the web interface, which limits the attack surface to insiders, compromised operator accounts, or environments where default credentials remain in place.

Root Cause

The root cause is missing bounds checking during string concatenation into fixed-size buffers. The poe_schedule_profile routine trusts the length of attacker-controlled schedule parameters and appends them without verifying that the cumulative size fits the destination buffer. This pattern is the classic form described in CWE-120.

Attack Vector

The attack is delivered over the network to the switch's HTTP or HTTPS management interface. An authenticated administrator submits a crafted PoE schedule profile request containing oversized values in one or more of the scheduling fields. The malformed request reaches the vulnerable handler and triggers the overflow.

Technical details of the vulnerable code path are documented in the VulnCheck Advisory on the DrayTek VigorSwitch buffer overflow.

Detection Methods for CVE-2026-71937

Indicators of Compromise

• Unexpected restarts or crashes of the VigorSwitch management service or the entire switch.
• HTTP or HTTPS POST requests to PoE schedule configuration endpoints containing abnormally long values in start_date, start_time, duration_time, how_often, weekdays, monthly_date, or cycle_duration.
• Administrative logins from unexpected source IPs shortly before management-plane instability.
• New or modified PoE schedule profiles that were not created by authorized change requests.

Detection Strategies

• Inspect web management logs for requests to PoE scheduling endpoints where field lengths exceed expected UI-imposed limits.
• Correlate switch reboot events and syslog crash traces with recent authenticated sessions to the web interface.
• Alert on repeated failed administrative logins that precede successful authentication, which may indicate credential brute forcing before exploitation.

Monitoring Recommendations

• Forward VigorSwitch syslog and authentication events to a centralized SIEM for correlation with configuration changes.
• Baseline normal PoE schedule configuration activity and alert on deviations in request size, frequency, or source.
• Monitor management VLAN traffic for anomalous HTTP or HTTPS payload sizes directed at switch administrative interfaces.

How to Mitigate CVE-2026-71937

Immediate Actions Required

• Apply the firmware updates published in the DrayTek Security Advisory for each affected VigorSwitch model.
• Restrict access to the switch web management interface to a dedicated management VLAN and a small set of trusted administrative hosts.
• Rotate all administrative credentials and remove any default or shared accounts on affected switches.
• Enforce multi-factor authentication or jump-host access for administrators who configure network infrastructure.

Patch Information

DrayTek has published firmware updates addressing this vulnerability. Refer to the DrayTek Security Advisory for the fixed firmware versions applicable to each VigorSwitch model. Upgrade all in-scope switches to the patched firmware and verify the running version after reboot.

Workarounds

• Disable remote administrative access to the web interface from untrusted networks until firmware can be applied.
• Block inbound HTTP and HTTPS traffic to switch management IP addresses at the network perimeter and internal firewalls.
• Limit the accounts permitted to modify PoE scheduling profiles and audit their use.
• If PoE scheduling is not required, avoid creating or editing PoE schedule profiles on unpatched devices.