CVE-2026-71942: DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mailmailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to reach the device's web management interface and authenticate with valid administrative credentials. The issue can then be triggered remotely using crafted input.
What is the potential impact of successful exploitation?
Successful exploitation can cause a denial of service and may potentially allow arbitrary command execution on the affected switch.
Which configuration area is involved?
The vulnerable code processes multiple smtpReceiver email addresses in the mail_mailalert function. Configurations that supply crafted or excessive recipient address input to this functionality are relevant to exploitation.
Is an unauthenticated attacker affected by this issue?
The provided information states that valid administrative credentials are required. It does not describe unauthenticated exploitation.