CVE-2026-71937: DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poescheduleprofile function. The vulnerability is caused by repeated concatenation of the startdate, starttime, durationtime, howoften, weekdays, monthlydate, and cycleduration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
DrayTek VigorSwitch devices whose web management interface is reachable by an attacker with valid administrative credentials are exposed. The issue is in the PoE schedule profile handling function.
What does an attacker need to exploit it?
An attacker needs valid administrator credentials for the device web management interface and must submit crafted values for PoE schedule profile fields. No user interaction is required.
What impact could successful exploitation have?
Successful exploitation can cause a denial of service and may allow arbitrary command execution. The vulnerability affects confidentiality, integrity, and availability.
How can I identify potentially vulnerable devices?
Identify DrayTek VigorSwitch devices in your environment and review whether administrators can configure PoE schedule profiles through the web management interface. Devices with administrative web access should be treated as potentially affected until evaluated against the vendor advisory.