What’s Vulnerable › Vulnerabilities

CVE-2026-71937: DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-12
• Weakness: CWE-120

Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

• DrayTek Corporation VigorSwitch FX2120: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch G2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1281x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch P2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch P2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P2542xh: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch PQ2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2200xb: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2300xb: before 2.10.7 — fixed in 2.10.7
• DrayTek Corporation VigorSwitch PX2060: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2200x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2300x: before 2.10.7 — fixed in 2.10.7

How to fix

Upgrade to a fixed version: DrayTek Corporation VigorSwitch FX2120 3.9.10; DrayTek Corporation VigorSwitch G1280 2.9.10; DrayTek Corporation VigorSwitch G1282 2.9.10; DrayTek Corporation VigorSwitch G2100 2.9.10; DrayTek Corporation VigorSwitch G2121 2.9.10; DrayTek Corporation VigorSwitch G2280x 2.9.10; DrayTek Corporation VigorSwitch G2282x 2.10.6; DrayTek Corporation VigorSwitch G2540x 2.9.10; DrayTek Corporation VigorSwitch G2540xs 3.9.10; DrayTek Corporation VigorSwitch G2542x 3.10.6; DrayTek Corporation VigorSwitch P1280 2.9.10; DrayTek Corporation VigorSwitch P1281x 2.9.10. Check the vendor advisory for mitigations.

References

• https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
• https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-poe-schedule-profile

Get alerted when CVE-2026-71937 or the next vulnerability affects your stack