CVE-2026-71940 is a classic buffer overflow vulnerability affecting multiple DrayTek VigorSwitch models, specifically the G2540xs. The flaw arises from improper handling of the name field in the acl_general_setup Edit ACE function, where input is copied into a fixed-size buffer without length checks. An attacker with valid administrative credentials can exploit this vulnerability remotely via the device's web management interface to cause denial of service or potentially execute arbitrary commands. The CVSS 4.0 base score is 8.6, reflecting high impact and exploitability with high privileges required and no user interaction needed. No vendor advisory or patch information is currently available.

Successful exploitation can cause denial of service or potentially allow arbitrary command execution on the affected device. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users. The vulnerability affects device stability and security, potentially compromising network infrastructure managed by the affected switches.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for unusual activity on the device's management interface. No vendor-provided temporary fixes or workarounds are currently documented.