CVE-2026-71937: DrayTek Corporation Vigorswitch FX2120

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

Published 2026-08-24. Last modified 2026-08-26.