CVE-2026-71936: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in DrayTek Corporation VigorSwitch G2540xs

CVE-2026-71936 is a classic buffer overflow vulnerability in multiple DrayTek VigorSwitch models, specifically in the sysreboot function. The issue is caused by unsafe concatenation of split valueN data into a fixed-size buffer, which can be triggered remotely by an attacker who has valid administrative credentials to the device's web management interface. Exploitation can lead to denial of service or arbitrary command execution. No official patch or remediation level has been provided in the available data.

Successful exploitation requires administrative privileges and can result in denial of service or arbitrary command execution on the affected device. This could disrupt network operations or allow an attacker to gain control over the device.

No official patch or remediation guidance is currently available. Since exploitation requires administrative credentials, it is recommended to restrict and monitor administrative access to the device's web management interface. Check the vendor advisory regularly for updates on patches or official mitigations.