CVE-2026-71939: DrayTek VigorSwitch Buffer Overflow Vulnerability

CVE-2026-71939 Overview

CVE-2026-71939 is a buffer overflow vulnerability [CWE-120] affecting multiple DrayTek VigorSwitch models. The flaw resides in the acl_general_setup Add ACE (Access Control Entry) function of the web management interface. The function copies the name field into a fixed-size buffer without validating its length. An authenticated attacker with administrative credentials can send crafted input to trigger memory corruption. Successful exploitation can cause a denial-of-service condition or potentially allow arbitrary command execution on the switch.

Critical Impact
Remote authenticated attackers can crash affected VigorSwitch devices or execute arbitrary commands, compromising confidentiality, integrity, and availability of network switching infrastructure.

Affected Products

Multiple DrayTek VigorSwitch models (see vendor advisory for the full model and firmware matrix)
Devices exposing the web management interface to attacker-reachable networks
Deployments where administrative credentials may be shared, reused, or exposed

Discovery Timeline

2026-08-24 - CVE-2026-71939 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71939

Vulnerability Analysis

The vulnerability exists in the Add ACE routine within the acl_general_setup handler of the VigorSwitch web management interface. When an administrator submits a new Access Control Entry, the handler copies the user-supplied name field directly into a fixed-size stack or global buffer. No length check bounds the copy operation, so an oversized name parameter overwrites adjacent memory.

Because the overflow occurs in an authenticated administrative endpoint, exploitation requires valid credentials. However, authentication does not mitigate the memory corruption itself. Attackers who obtain administrative access — through credential theft, phishing, or default password reuse — can leverage the flaw to move beyond configuration abuse and into code execution on the underlying firmware. The device sits at the network layer, so a compromise affects segmentation, monitoring, and downstream hosts.

Root Cause

The root cause is missing input validation on the name field of the Add ACE request. The affected function uses an unsafe copy pattern equivalent to strcpy or a memcpy with an attacker-controlled length into a fixed-size destination. This classic buffer overflow pattern [CWE-120] permits stack or heap metadata corruption depending on where the destination buffer resides.

Attack Vector

The attack path is network-based against the VigorSwitch HTTP or HTTPS management interface. An authenticated attacker submits a crafted Add ACE request containing a name value that exceeds the target buffer. The malformed request drives the vulnerable copy operation, corrupting adjacent memory. The result is either a device crash and reboot loop, causing denial of service, or hijacked control flow leading to arbitrary command execution in the context of the management process. No user interaction is required beyond the attacker-initiated request. Refer to the VulnCheck Advisory: DrayTek Buffer Overflow for additional technical detail.

Detection Methods for CVE-2026-71939

Indicators of Compromise

Unexpected reboots, crashes, or watchdog resets of VigorSwitch devices following administrative activity
HTTP or HTTPS POST requests to ACL configuration endpoints containing abnormally long name parameter values
New or modified ACL entries that do not match change-management records
Administrative sessions originating from unfamiliar source IP addresses or at unusual times

Detection Strategies

Inspect web server and management-plane logs for Add ACE requests where the name field exceeds expected length limits
Correlate device reboots or SNMP coldStart traps with recent management interface activity
Baseline normal ACL change frequency and alert on outliers
Monitor for authentication events from geographies or hosts that should not manage network gear

Monitoring Recommendations

Forward VigorSwitch syslog and management-interface access logs to a centralized logging platform
Alert on repeated administrative logins followed by device crashes or configuration errors
Track firmware versions across the fleet to identify devices missing the DrayTek August 2026 patch

How to Mitigate CVE-2026-71939

Immediate Actions Required

Apply the firmware updates listed in the DrayTek Security Advisory: August 2026 as soon as they are available for each affected model
Restrict access to the VigorSwitch web management interface to a dedicated management VLAN or jump host
Rotate administrative credentials and enforce strong, unique passwords for each device
Disable HTTP/HTTPS management on WAN or untrusted interfaces

Patch Information

DrayTek has published fixed firmware in its August 2026 security advisory. Consult the DrayTek Security Advisory: August 2026 for the specific firmware version corresponding to each VigorSwitch model, and validate hashes before deployment. Coordinate patching windows with network change control because the switches sit inline with production traffic.

Workarounds

Limit management interface access with ACLs that permit only authorized administrator workstations
Terminate management sessions and enforce short session timeouts to reduce credential exposure
Require multi-factor authentication on jump hosts used to reach VigorSwitch management interfaces
Monitor and rate-limit ACL configuration changes until firmware is applied

bash

# Example: restrict VigorSwitch management to a dedicated admin subnet at the upstream firewall
# Replace 203.0.113.0/28 with your authorized management network and 10.10.0.10 with the switch IP
iptables -A FORWARD -s 203.0.113.0/28 -d 10.10.0.10 -p tcp -m multiport --dports 80,443 -j ACCEPT
iptables -A FORWARD -d 10.10.0.10 -p tcp -m multiport --dports 80,443 -j DROP