CVE-2026-71941: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in DrayTek Corporation VigorSwitch G2540xs

The vulnerability in DrayTek VigorSwitch G2540xs arises from a classic buffer overflow in the diag_logmail function. Specifically, the function concatenates multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size, leading to overflow. Exploitation requires authenticated administrative access to the device's web management interface. Successful exploitation can result in denial of service or arbitrary code execution. The CVSS 4.0 base score is 8.6, indicating high severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Exploitation of this vulnerability can cause denial of service on affected devices or potentially allow execution of arbitrary commands, which could compromise device integrity and network security. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users or attackers who have obtained such credentials.

No official patch or remediation guidance is currently available. Users should restrict administrative access to trusted personnel and networks, monitor for unauthorized access attempts, and check the vendor's advisory for updates regarding patches or mitigations.