EUVD-2026-65001
GHSA-33fw-8wrj-c6pw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain admin credentials via phishing or reuse
-
DeliveryConnect to web management interface over network
-
ExploitSubmit crafted smtpReceiver email address payload
-
ExecutionTrigger buffer overflow in mail_mailalert function
-
ImpactCause management process crash (DoS) or execute arbitrary commands on switch
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - confirmed both by the CVE description and the CVSS 4.0 PR:H metric. The vulnerable code path is the email alert configuration functionality (smtpReceiver field), which must be reachable within the management UI; the mail alert feature does not need to be actively enabled, only accessible. Network connectivity to the management interface is required (AV:N). Exploitation is blocked without administrative authentication - unprivileged or unauthenticated network access is insufficient. Network segmentation isolating the management interface (e.g., a dedicated out-of-band management VLAN with restricted access) further limits exposure. No non-default protocol or configuration beyond management interface access is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) signals a network-exploitable, high-impact flaw gated behind administrative authentication. The PR:H requirement is the dominant mitigating factor - without admin credentials, the vulnerability is not reachable. No EPSS data was provided, this CVE is not listed in CISA KEV, and no public exploit code has been identified, all of which temper urgency relative to the raw score. However, managed network switch infrastructure is a high-value target: post-authentication RCE on a switch controlling network segmentation would represent a serious foothold, and admin credential exposure via phishing or credential reuse is a realistic precursor. The scope metrics (SC:N/SI:N/SA:N) confirm no automatic lateral scope change, but physical network control means the practical blast radius is broader than the CVSS scope metrics suggest. Organizations with internet-exposed management interfaces face meaningfully higher risk than those with properly segmented management planes. |
| Exploit ScenarioDerived | An attacker who has obtained valid administrative credentials - through credential reuse, phishing, or a prior breach - connects to the VigorSwitch web management interface over the network and submits a crafted mail alert configuration containing an excessive number of or excessively long smtpReceiver email address entries. The mail_mailalert function concatenates these into a fixed-size buffer without bounds checking, overflowing into adjacent memory; depending on memory layout and firmware version, the result is either a management process crash causing denial of service, or control-flow hijack enabling arbitrary command execution on the switch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Buffer overflow in DrayTek VigorSwitch's mail_mailalert function allows authenticated remote attackers with valid administrative credentials to cause a denial of service or potentially execute arbitrary commands across approximately 28 affected managed switch models. The flaw stems from unbounded concatenation of multiple SMTP receiver email addresses into a fixed-size buffer, reachable via the device's web management interface. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 8.6 reflects high potential impact to confidentiality, integrity, and availability.
RemediationAI
Apply firmware updates per the DrayTek security advisory at https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/ - specific patched firmware version numbers are not available in the provided data and must be confirmed directly from the advisory. As an immediate compensating control, restrict access to the web management interface to dedicated management VLANs or specific trusted IP ranges, and disable any internet-facing management access - this substantially reduces the exploitable attack surface without patching. If the email alert feature (smtpReceiver configuration) is not operationally required, disabling it in the device configuration eliminates the vulnerable code path entirely with no functional trade-off for organizations that do not use SMTP alerting. Enforce strong, unique administrative credentials and audit existing admin accounts to reduce the risk of credential-based precursor attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 28 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the mail_mailalert function implemented across the DrayTek VigorSwitch firmware shared by a broad range of managed switch models. CWE-120 (Classic Buffer Copy without Checking Size of Input) is the root cause: the function iterates over smtpReceiver email address entries and concatenates them into a statically allocated buffer without tracking remaining capacity, enabling a write beyond the buffer boundary. CPE data confirms at least ten models (VigorSwitch G2540XS, P2540XS, FX2120, G2282X, P2282X, Q2300X, PQ2300XB, G2542X, P2542X, P2542XH), while the VulnCheck tags extend the affected set to approximately 28 additional models spanning the G-series, P-series, Q-series, and PQ-series VigorSwitch lines. The shared codebase across these models is consistent with a single firmware branch containing the vulnerable mail alert subsystem.
Know when Vigorswitch G2540Xs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Admin credentials explicitly required (PR:H); network-accessible management interface (AV:N, AC:L); impact confined to the vulnerable switch with no scope change (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Executive ViewAI
A buffer overflow vulnerability (CVE-2026-71942) in DrayTek VigorSwitch network switches affects approximately 28 models and could allow attackers with valid administrative credentials to disrupt network operations or execute arbitrary commands. The vulnerability directly threatens business continuity for organizations relying on these managed switches for network infrastructure. No vendor patch is currently available, requiring immediate protective measures to reduce risk.
No vendor-released patch identified at time of analysis. Restrict administrative access through network segmentation, firewall rules, or VPN requirements; require multi-factor authentication for all administrative credentials; disable the mail alert feature if operationally feasible; implement comprehensive logging and monitoring of administrative interface access and configuration modifications; conduct regular audits of administrative user accounts and access privileges; maintain a current inventory of affected DrayTek VigorSwitch models for prioritized patching when vendor updates become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Vigorswitch G2540Xs
View allPre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker
Command injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary
Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS
Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS co
Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers hold
Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbit
Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to
Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute
Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator
Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arb
Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute
Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple fir
Exploit-DB