CVE-2026-71921: DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to exploitation?
DrayTek VigorSwitch devices running an affected model are exposed if their setget.cgi interface is reachable by a remote attacker. The issue requires no authentication or user interaction.
What level of access can an attacker obtain?
An attacker can submit crafted input through the pass field to execute arbitrary operating-system commands with root privileges. This can result in complete compromise of the affected switch.
How can I determine whether my device is affected?
Identify whether the device is a DrayTek VigorSwitch model and consult DrayTek's August 2026 VigorSwitch security advisory for the affected-model and remediation details. The provided information does not list specific models or fixed firmware versions.