What’s Vulnerable › Vulnerabilities
CVE-2026-71942: DrayTek VigorSwitch Multiple Models Buffer Overflow via mail_mailalert
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-24 · updated 2026-10-12
- Weakness: CWE-120
Description
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected products
- DrayTek Corporation VigorSwitch FX2120: before 3.9.10 — fixed in 3.9.10
- DrayTek Corporation VigorSwitch G1280: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G1282: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G2100: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G2121: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G2280x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G2282x: before 2.10.6 — fixed in 2.10.6
- DrayTek Corporation VigorSwitch G2540x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch G2540xs: before 3.9.10 — fixed in 3.9.10
- DrayTek Corporation VigorSwitch G2542x: before 3.10.6 — fixed in 3.10.6
- DrayTek Corporation VigorSwitch P1280: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P1281x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P1282: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P2100: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P2121: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P2280x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P2282x: before 2.10.6 — fixed in 2.10.6
- DrayTek Corporation VigorSwitch P2540x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch P2540xs: before 3.9.10 — fixed in 3.9.10
- DrayTek Corporation VigorSwitch P2542x: before 3.10.6 — fixed in 3.10.6
- DrayTek Corporation VigorSwitch P2542xh: before 3.10.6 — fixed in 3.10.6
- DrayTek Corporation VigorSwitch PQ2121x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch PQ2200xb: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch PQ2300xb: before 2.10.7 — fixed in 2.10.7
- DrayTek Corporation VigorSwitch PX2060: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch Q2121x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch Q2200x: before 2.9.10 — fixed in 2.9.10
- DrayTek Corporation VigorSwitch Q2300x: before 2.10.7 — fixed in 2.10.7
How to fix
Upgrade to a fixed version: DrayTek Corporation VigorSwitch FX2120 3.9.10; DrayTek Corporation VigorSwitch G1280 2.9.10; DrayTek Corporation VigorSwitch G1282 2.9.10; DrayTek Corporation VigorSwitch G2100 2.9.10; DrayTek Corporation VigorSwitch G2121 2.9.10; DrayTek Corporation VigorSwitch G2280x 2.9.10; DrayTek Corporation VigorSwitch G2282x 2.10.6; DrayTek Corporation VigorSwitch G2540x 2.9.10; DrayTek Corporation VigorSwitch G2540xs 3.9.10; DrayTek Corporation VigorSwitch G2542x 3.10.6; DrayTek Corporation VigorSwitch P1280 2.9.10; DrayTek Corporation VigorSwitch P1281x 2.9.10. Check the vendor advisory for mitigations.
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-buffer-overflow-via-mail-mailalert
Get alerted when CVE-2026-71942 or the next vulnerability affects your stack