Skip to content
OpenAdvisories
High · 7.2 CVE-2026-71940 EUVD-2026-64999GHSA-pfv2-vr3v-8f3r

DrayTek VigorSwitch Multiple Models Buffer Overflow via acl_general_setup Edit ACE

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by VulnCheck

Vendor: DrayTek Product: VigorSwitch FX2120 Product: VigorSwitch G1280 Product: VigorSwitch G1282 Product: VigorSwitch G2100 Product: VigorSwitch G2121 Product: VigorSwitch G2280x Product: VigorSwitch G2282x Product: VigorSwitch G2540x Product: VigorSwitch G2540xs Product: VigorSwitch G2542x Product: VigorSwitch P1280 Product: VigorSwitch P1281x Product: VigorSwitch P1282 Product: VigorSwitch P2100 Product: VigorSwitch P2121 Product: VigorSwitch P2280x Product: VigorSwitch P2282x Product: VigorSwitch P2540x Product: VigorSwitch P2540xs Product: VigorSwitch P2542x Product: VigorSwitch P2542xh Product: VigorSwitch PQ2121x Product: VigorSwitch PQ2200xb Product: VigorSwitch PQ2300xb Product: VigorSwitch PX2060 Product: VigorSwitch Q2121x Product: VigorSwitch Q2200x Product: VigorSwitch Q2300x Category: Network devices

Description

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

VendorProductAffectedFixed
DrayTek VigorSwitch G2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch P2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch FX2120 < 3.9.10 3.9.10
DrayTek VigorSwitch G2282x < 2.10.6 2.10.6
DrayTek VigorSwitch P2282x < 2.10.6 2.10.6
DrayTek VigorSwitch Q2300x < 2.10.7 2.10.7
DrayTek VigorSwitch PQ2300xb < 2.10.7 2.10.7
DrayTek VigorSwitch G2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542xh < 3.10.6 3.10.6
DrayTek VigorSwitch PX2060 < 2.9.10 2.9.10
DrayTek VigorSwitch G1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1281x < 2.9.10 2.9.10
DrayTek VigorSwitch G1282 < 2.9.10 2.9.10
DrayTek VigorSwitch P1282 < 2.9.10 2.9.10
DrayTek VigorSwitch G2121 < 2.9.10 2.9.10
DrayTek VigorSwitch P2121 < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2121x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2121x < 2.9.10 2.9.10
DrayTek VigorSwitch G2280x < 2.9.10 2.9.10
DrayTek VigorSwitch P2280x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2200x < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2200xb < 2.9.10 2.9.10
DrayTek VigorSwitch G2100 < 2.9.10 2.9.10
DrayTek VigorSwitch P2100 < 2.9.10 2.9.10
DrayTek VigorSwitch G2540x < 2.9.10 2.9.10
DrayTek VigorSwitch P2540x < 2.9.10 2.9.10

Advisories 2

References