CVE-2026-71934 [HIGH] – Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtra

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device’s web management interface.