CVE-2026-71918
Received Received - Intake

Command Injection in DrayTek VigorSwitch

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71918
EUVD
EUVD-2026-64977

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
draytek vigorswitch From PQ (inc)
draytek vigorswitch *
draytek vigorswitch From G (inc) to PQ (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-71918 is an OS command injection vulnerability in multiple DrayTek VigorSwitch models. It exists in the webBackupAction function due to insufficient input validation of fields like option, key, pw_encode, pathN, and valueN. This allows remote attackers to execute arbitrary commands with root privileges if they have valid administrative credentials for the device's web management interface.

Detection Guidance

Detecting this vulnerability requires checking if your DrayTek VigorSwitch devices are running vulnerable firmware versions. Log in to the web management interface and inspect the firmware version under system settings. Compare it against the affected model ranges listed in DrayTek's advisory. Network scanning tools like Nmap can identify VigorSwitch devices but cannot confirm this specific vulnerability without manual verification.

Impact Analysis

An attacker could gain full control of the affected device, leading to potential data breaches, network compromise, or disruption of services. Since the commands execute with root privileges, the attacker could manipulate the device's configuration, steal sensitive information, or use it as a pivot point to attack other systems on the network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. Organizations may face legal penalties, reputational damage, and loss of trust due to compromised sensitive data or failure to protect user information.

Mitigation Strategies

Immediately update affected DrayTek VigorSwitch devices to the latest firmware provided by DrayTek. Disable remote administration if not required and restrict administrative access to trusted IP addresses. Monitor network traffic for unusual activity from the web management interface. Consider isolating vulnerable devices from critical network segments until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71918. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart