Read the docs
TI-2026-50232 Aliases CVE-2026-71937GHSA-75q7-4wfq-wpxr

DrayTek VigorSwitch Multiple Models Buffer Overflow via poe_schedule_profile

Priority MEDIUM 40CWE-120Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the poe_schedule_profile function. The vulnerability is caused by repeated concatenation of the start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00683 52nd percentileScored 2026-11-07
Fix Fixed VigorSwitch G2540xs (DrayTek Corporation): 3.9.10VigorSwitch P2540xs (DrayTek Corporation): 3.9.10+26 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigorSwitch G2540xsbefore 3.9.103.9.10Patch availableCNA
DrayTekVigorSwitch P2540xsbefore 3.9.103.9.10Patch availableCNA
DrayTekVigorSwitch FX2120before 3.9.103.9.10Patch availableCNA
DrayTekVigorSwitch G2282xbefore 2.10.62.10.6Patch availableCNA
DrayTekVigorSwitch P2282xbefore 2.10.62.10.6Patch availableCNA
DrayTekVigorSwitch Q2300xbefore 2.10.72.10.7Patch availableCNA
DrayTekVigorSwitch PQ2300xbbefore 2.10.72.10.7Patch availableCNA
DrayTekVigorSwitch G2542xbefore 3.10.63.10.6Patch availableCNA
DrayTekVigorSwitch P2542xbefore 3.10.63.10.6Patch availableCNA
DrayTekVigorSwitch P2542xhbefore 3.10.63.10.6Patch availableCNA
DrayTekVigorSwitch PX2060before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G1280before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P1280before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P1281xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G1282before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P1282before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G2121before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P2121before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch PQ2121xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch Q2121xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G2280xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P2280xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch Q2200xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch PQ2200xbbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G2100before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P2100before 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch G2540xbefore 2.9.102.9.10Patch availableCNA
DrayTekVigorSwitch P2540xbefore 2.9.102.9.10Patch availableCNA
  • VigorSwitch G2540xs VendorDrayTek Affected before 3.9.10 Fixed in 3.9.10 Patch available CNA
  • VigorSwitch P2540xs VendorDrayTek Affected before 3.9.10 Fixed in 3.9.10 Patch available CNA
  • VigorSwitch FX2120 VendorDrayTek Affected before 3.9.10 Fixed in 3.9.10 Patch available CNA
  • VigorSwitch G2282x VendorDrayTek Affected before 2.10.6 Fixed in 2.10.6 Patch available CNA
  • VigorSwitch P2282x VendorDrayTek Affected before 2.10.6 Fixed in 2.10.6 Patch available CNA
  • VigorSwitch Q2300x VendorDrayTek Affected before 2.10.7 Fixed in 2.10.7 Patch available CNA
  • VigorSwitch PQ2300xb VendorDrayTek Affected before 2.10.7 Fixed in 2.10.7 Patch available CNA
  • VigorSwitch G2542x VendorDrayTek Affected before 3.10.6 Fixed in 3.10.6 Patch available CNA
  • VigorSwitch P2542x VendorDrayTek Affected before 3.10.6 Fixed in 3.10.6 Patch available CNA
  • VigorSwitch P2542xh VendorDrayTek Affected before 3.10.6 Fixed in 3.10.6 Patch available CNA
  • VigorSwitch PX2060 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G1280 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P1280 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P1281x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G1282 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P1282 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G2121 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P2121 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch PQ2121x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch Q2121x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G2280x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P2280x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch Q2200x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch PQ2200xb VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G2100 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P2100 VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch G2540x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA
  • VigorSwitch P2540x VendorDrayTek Affected before 2.9.10 Fixed in 2.9.10 Patch available CNA

Remediation

  • Fix · CNA VigorSwitch G2540xs (DrayTek Corporation) Fixed in 3.9.10
  • Fix · CNA VigorSwitch P2540xs (DrayTek Corporation) Fixed in 3.9.10
  • Fix · CNA VigorSwitch FX2120 (DrayTek Corporation) Fixed in 3.9.10
  • Fix · CNA VigorSwitch G2282x (DrayTek Corporation) Fixed in 2.10.6
  • Fix · CNA VigorSwitch P2282x (DrayTek Corporation) Fixed in 2.10.6
  • Fix · CNA VigorSwitch Q2300x (DrayTek Corporation) Fixed in 2.10.7
  • Fix · CNA VigorSwitch PQ2300xb (DrayTek Corporation) Fixed in 2.10.7
  • Fix · CNA VigorSwitch G2542x (DrayTek Corporation) Fixed in 3.10.6
  • Fix · CNA VigorSwitch P2542x (DrayTek Corporation) Fixed in 3.10.6
  • Fix · CNA VigorSwitch P2542xh (DrayTek Corporation) Fixed in 3.10.6
  • Fix · CNA VigorSwitch PX2060 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G1280 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P1280 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P1281x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G1282 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P1282 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G2121 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P2121 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch PQ2121x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch Q2121x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G2280x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P2280x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch Q2200x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch PQ2200xb (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G2100 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P2100 (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch G2540x (DrayTek Corporation) Fixed in 2.9.10
  • Fix · CNA VigorSwitch P2540x (DrayTek Corporation) Fixed in 2.9.10

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    DrayTek VigorSwitch FX2120, VigorSwitch G1280 and 26 more products — draytek.com/about/security-advisory/multiple-vulnerabilitie…

    29 records Highest priority Priority MEDIUM 27 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-50216 DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgiPriority MEDIUM 53
    • TI-2026-50228 DrayTek VigorSwitch Multiple Models Missing Authorization in Syslog FunctionsPriority MEDIUM 47
    • TI-2026-50217 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgiPriority MEDIUM 45
    Show all 29 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-71937
  2. 2026-10-03 Alias added: GHSA-75q7-4wfq-wpxr

References

Advisory 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences