CVE-2026-71937

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch (affected versions not specified)

Description A buffer overflow occurs in the poe schedule profile() function. This issue arises from the repeated concatenation of the start date, start time, duration time, how often, weekdays, monthly date, and cycle duration fields into small fixed-size buffers without adequate length verification. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to trigger a denial of service or potentially execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.