CVE-2026-71937 in VigorSwitch G1280
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The DrayTek VigorSwitch series contains a critical buffer overflow vulnerability located within the poe_schedule_profile function of its firmware. This flaw stems from improper handling of user-supplied input during the configuration of Power over Ethernet scheduling profiles. Specifically, when an administrator attempts to set up or modify schedule parameters such as start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration, the system concatenates these fields into fixed-size buffers without performing adequate length validation checks. This lack of boundary verification allows crafted input data to exceed the allocated memory space, leading to a classic stack-based buffer overflow condition that corrupts adjacent memory structures including return addresses and control flow pointers.
From an operational perspective, this vulnerability presents significant risks depending on how it is exploited by an attacker with valid administrative credentials for the device's web management interface. The most immediate impact is a denial of service, where the malformed input causes the switch to crash or reboot repeatedly, disrupting network connectivity and power delivery to connected devices such as IP cameras, VoIP phones, or wireless access points. However, given that buffer overflows often allow for arbitrary code execution, an authenticated attacker could potentially leverage this flaw to execute malicious commands with the privileges of the affected service process. This could lead to full device compromise, allowing the attacker to pivot into other network segments, exfiltrate sensitive data, or establish persistent backdoors within the infrastructure.
The requirement for valid administrative credentials classifies this vulnerability as an authenticated attack vector, which aligns with MITRE ATT&CK techniques related to Command and Scripting Interpreter execution via local exploits or API abuse. While authentication acts as a partial barrier against remote unauthenticated attackers, it does not mitigate insider threats or risks posed by compromised admin accounts. The underlying technical flaw corresponds closely to CWE-120 Buffer Copy without Checking Size of Input Classic buffer overflow and CWE-787 Out-of-bounds Write, highlighting the fundamental failure in input validation during memory manipulation operations.
To mitigate this risk, organizations should immediately apply vendor-provided firmware updates that address the boundary checks within the poe_schedule_profile function. Until patches are available, it is advisable to restrict access to the web management interface through strict network segmentation and firewall rules, ensuring only trusted administrative workstations can reach the device's management port. Additionally, implementing strong password policies and multi-factor authentication for administrative accounts reduces the likelihood of credential compromise that could lead to exploitation of this vulnerability. Regular auditing of configuration changes and monitoring for unusual system behavior or service restarts can also aid in early detection of potential exploitation attempts.