DrayTek VigorSwitch PX2060 poe_schedule_profile buffer overflow

Summaryinfo

A vulnerability described as very critical has been identified in DrayTek VigorSwitch G1280, VigorSwitch G1282, VigorSwitch G2100, VigorSwitch G2121, VigorSwitch G2280x, VigorSwitch G2282x, VigorSwitch G2540x, VigorSwitch G2540xs, VigorSwitch G2542x, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch P1282, VigorSwitch P2100, VigorSwitch P2121, VigorSwitch P2280x, VigorSwitch P2282x, VigorSwitch P2540x, VigorSwitch P2540xs, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PQ2121x, VigorSwitch PQ2200xb, VigorSwitch PQ2300xb, VigorSwitch Q2121x, VigorSwitch Q2200x, VigorSwitch Q2300x and VigorSwitch PX2060. This affects the function poe_schedule_profile. The manipulation of the argument start_date/start_time/duration_time/how_often/weekdays/monthly_date/cycle_duration results in buffer overflow. This vulnerability is known as CVE-2026-71937. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, was found in DrayTek VigorSwitch G1280, VigorSwitch G1282, VigorSwitch G2100, VigorSwitch G2121, VigorSwitch G2280x, VigorSwitch G2282x, VigorSwitch G2540x, VigorSwitch G2540xs, VigorSwitch G2542x, VigorSwitch P1280, VigorSwitch P1281x, VigorSwitch P1282, VigorSwitch P2100, VigorSwitch P2121, VigorSwitch P2280x, VigorSwitch P2282x, VigorSwitch P2540x, VigorSwitch P2540xs, VigorSwitch P2542x, VigorSwitch P2542xh, VigorSwitch PQ2121x, VigorSwitch PQ2200xb, VigorSwitch PQ2300xb, VigorSwitch Q2121x, VigorSwitch Q2200x, VigorSwitch Q2300x and VigorSwitch PX2060. Affected is the function poe_schedule_profile. The manipulation of the argument start_date/start_time/duration_time/how_often/weekdays/monthly_date/cycle_duration with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

The advisory is available at draytek.com. This vulnerability is traded as CVE-2026-71937 since 08/08/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation requires an enhanced level of successful authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• DrayTek

Name

• VigorSwitch G1280
• VigorSwitch G1282
• VigorSwitch G2100
• VigorSwitch G2121
• VigorSwitch G2280x
• VigorSwitch G2282x
• VigorSwitch G2540x
• VigorSwitch G2540xs
• VigorSwitch G2542x
• VigorSwitch P1280
• VigorSwitch P1281x
• VigorSwitch P1282
• VigorSwitch P2100
• VigorSwitch P2121
• VigorSwitch P2280x
• VigorSwitch P2282x
• VigorSwitch P2540x
• VigorSwitch P2540xs
• VigorSwitch P2542x
• VigorSwitch P2542xh
• VigorSwitch PQ2121x
• VigorSwitch PQ2200xb
• VigorSwitch PQ2300xb
• VigorSwitch PX2060
• VigorSwitch Q2121x
• VigorSwitch Q2200x
• VigorSwitch Q2300x

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion