CVE-2026-71941: DrayTek Corporation Vigorswitch FX2120

High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the diag_logmail function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

Published 2026-08-24. Last modified 2026-08-27.