CVE-2026-71917
Received Received - Intake

Command Injection in DrayTek VigorSwitch

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71917
EUVD
EUVD-2026-64976

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
draytek vigorswitch *
draytek vigorswitch From 2026-08-01 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a command injection vulnerability in multiple DrayTek VigorSwitch models. It exists in the pingtrace function due to insufficient validation of the host field. A remote attacker with valid administrative credentials can exploit this to execute arbitrary commands with root privileges using crafted input.

Detection Guidance

Detecting this vulnerability requires checking if your DrayTek VigorSwitch models are affected. Review the device's web management interface logs for unusual pingtrace function usage or unexpected command executions. Network scanning tools like Nmap may help identify vulnerable models by matching CPEs or firmware versions.

Impact Analysis

An attacker could gain full control of the affected device, allowing them to manipulate network traffic, steal sensitive data, or disrupt operations. Since the commands execute with root privileges, the impact is severe and could lead to complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of customer trust due to compromised sensitive data.

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch devices to the latest firmware provided by DrayTek. Disable administrative access to the web interface from untrusted networks. Implement network segmentation to limit access to the device. Monitor for suspicious activity in logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71917. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart