CVE-2026-71926
Received Received - Intake

Command Injection in DrayTek VigorSwitch

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-71926
EUVD
EUVD-2026-64985

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
draytek vigorswitch *
draytek vigorswitch G2540xs
draytek vigorswitch P2540xs
draytek vigorswitch FX2120
draytek vigorswitch G2282x
draytek vigorswitch P2282x
draytek vigorswitch Q2300x

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Multiple DrayTek VigorSwitch models have a command injection flaw in the setDevice function. The issue arises because the username, password, and location fields are not properly sanitized before commands are executed. A remote attacker with valid admin credentials for the web interface can exploit this to run arbitrary commands as root.

Detection Guidance

Detecting this vulnerability requires checking DrayTek VigorSwitch models for command injection via the setDevice function. Inspect web management interface logs for unusual commands or inputs in username, password, or location fields. Network traffic analysis may reveal suspicious payloads targeting administrative interfaces.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary commands with root privileges on affected DrayTek VigorSwitch devices. This could lead to full system compromise, unauthorized access, data theft, or disruption of network operations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR or HIPAA. Organizations using affected devices may face regulatory penalties, legal liabilities, and reputational damage due to compromised data integrity or confidentiality.

Mitigation Strategies

Immediately update DrayTek VigorSwitch firmware to the latest patched version. Restrict administrative access to the web management interface via IP whitelisting or VPN. Monitor for unauthorized command execution attempts and disable unused services.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71926. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart