The DrayTek VigorSwitch G2540xs contains a classic buffer overflow vulnerability in the poe_schedule_profile function. The issue is due to repeated concatenation of fields such as start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration into small fixed-size buffers without checking input length. A remote attacker with valid administrative credentials on the device's web management interface can exploit this flaw to cause denial of service or potentially execute arbitrary commands. The vulnerability is tracked as CVE-2026-71937 with a CVSS 4.0 base score of 8.6 (high severity). There is no vendor advisory or patch information available at this time.

Successful exploitation allows an attacker with administrative access to the device's web interface to cause a denial of service or execute arbitrary commands on the affected device. This can disrupt network operations or lead to full compromise of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device's management interface.