CVE-2026-71941: DrayTek VigorSwitch Multiple Models Buffer Overflow via diag_logmail
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diaglogmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker must have valid administrative credentials for the device's web management interface. They can then submit crafted input that supplies multiple smtpReceiver email addresses.
Who is exposed to this vulnerability?
DrayTek VigorSwitch devices running an affected model are exposed when their web management interface can be reached by someone with administrative credentials. The provided information does not identify the specific affected models or firmware versions.
What can exploitation cause?
Successful exploitation can cause a denial of service and may potentially allow arbitrary command execution. The issue occurs when multiple smtpReceiver email addresses are concatenated into a fixed-size buffer without sufficient remaining-size checks.