CVE-2026-71939 is a buffer overflow vulnerability in multiple DrayTek VigorSwitch models, specifically in the acl_general_setup Add ACE function. The flaw arises from copying the name field into a fixed-size buffer without checking the input length, enabling a remote attacker with administrative privileges on the web management interface to trigger a denial of service or possibly execute arbitrary code. The vulnerability requires valid admin credentials and does not involve user interaction beyond that. No patch or official remediation information is currently available.

Successful exploitation can lead to denial of service or arbitrary command execution on the affected device. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device's management interface.