CVE-2026-71936 describes a classic buffer overflow vulnerability in multiple DrayTek VigorSwitch models, specifically in the sysreboot function. The issue arises from unsafe concatenation of split valueN data into a fixed-size buffer without proper size checking. A remote attacker with valid administrative credentials can trigger this vulnerability by sending crafted input through the device's web management interface, potentially causing denial of service or arbitrary command execution. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

The vulnerability allows an attacker with administrative privileges on the device's web interface to cause a denial of service or execute arbitrary commands remotely. This could lead to disruption of network operations or compromise of the device's integrity and control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the management interface.