CVE-2026-71934 describes a classic buffer overflow vulnerability in the pingtrace function of DrayTek VigorSwitch G2540xs. The issue arises because the host, count, and interval fields are concatenated into a fixed-size buffer without verifying their length, allowing crafted input to overflow the buffer. Exploitation requires authenticated access with administrative privileges to the device's web management interface. The vulnerability has a high CVSS 4.0 base score of 8.6, reflecting its potential impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

Successful exploitation can lead to denial of service or arbitrary command execution on the affected device, compromising its confidentiality, integrity, and availability. However, exploitation requires valid administrative credentials, limiting the attack surface to authenticated users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device's management interface.