CVE-2026-71938: DrayTek VigorSwitch Multiple Models Buffer Overflow via switch_lan_gvrp
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the switchlangvrp function. The vulnerability is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to reach the device's web management interface and possess valid administrative credentials. The provided information does not indicate that unauthenticated users can exploit it.
What impact can exploitation have?
A crafted portList value can trigger a buffer overflow, causing a denial of service or potentially allowing arbitrary command execution. The listed impact includes high confidentiality, integrity, and availability effects.
What input or feature is involved in the vulnerable path?
The vulnerable function is switch_lan_gvrp, where the portList field is copied into an undersized buffer. Administrators should treat crafted input to this field through the web management interface as the relevant attack path.