CVE-2026-71911 is a classic buffer overflow vulnerability in DrayTek VigorAP 918R caused by lack of input size validation in the setLan function. The vulnerability affects memory copy operations for lanVlanId0, lanIp, and lanNetmask fields. A remote attacker with valid admin credentials can exploit this flaw by sending crafted input to the web management interface, resulting in denial of service or possible arbitrary command execution. No patch or official remediation information is currently available.

Successful exploitation allows an attacker with administrative privileges to cause denial of service or potentially execute arbitrary commands on the affected device. This could disrupt network operations or compromise device integrity. However, exploitation requires valid administrative credentials, limiting the attacker's initial access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unauthorized access attempts. No official fix or temporary workaround has been published by the vendor at this time.