CVE-2026-71937: falha de alta gravidade em DrayTek Corporation VigorSwitch FX2120
DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.7%
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
DrayTek Corporation · VigorSwitch FX2120DrayTek Corporation · VigorSwitch G1280DrayTek Corporation · VigorSwitch G1282DrayTek Corporation · VigorSwitch G2100DrayTek Corporation · VigorSwitch G2121DrayTek Corporation · VigorSwitch G2280xDrayTek Corporation · VigorSwitch G2282xDrayTek Corporation · VigorSwitch G2540xDrayTek Corporation · VigorSwitch G2540xsDrayTek Corporation · VigorSwitch G2542xDrayTek Corporation · VigorSwitch P1280DrayTek Corporation · VigorSwitch P1281xDrayTek Corporation · VigorSwitch P1282DrayTek Corporation · VigorSwitch P2100DrayTek Corporation · VigorSwitch P2121DrayTek Corporation · VigorSwitch P2280xDrayTek Corporation · VigorSwitch P2282xDrayTek Corporation · VigorSwitch P2540xDrayTek Corporation · VigorSwitch P2540xsDrayTek Corporation · VigorSwitch P2542xDrayTek Corporation · VigorSwitch P2542xhDrayTek Corporation · VigorSwitch PQ2121xDrayTek Corporation · VigorSwitch PQ2200xbDrayTek Corporation · VigorSwitch PQ2300xbDrayTek Corporation · VigorSwitch PX2060DrayTek Corporation · VigorSwitch Q2121xDrayTek Corporation · VigorSwitch Q2200xDrayTek Corporation · VigorSwitch Q2300xCVEs relacionadas — DrayTek Corporation VigorSwitch FX2120
No mesmo produto, das mais perigosas para as menos.
CVE-2026-71921CRITICALDrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgiEPSS 2.8%CVE-2026-71943HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevNetEPSS 2.3%CVE-2026-71930HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setTimeEPSS 2.3%CVE-2026-71929HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via setDevProtoEPSS 2.3%CVE-2026-71928HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via fdftDeviceEPSS 2.3%CVE-2026-71927HIGHDrayTek VigorSwitch Multiple Models OS Command Injection via rebDeviceEPSS 2.3%