CVE-2026-71917: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability in DrayTek VigorSwitch G2540xs arises from improper neutralization of special elements in the pingtrace function's host parameter. The lack of sufficient input validation allows a remote attacker, who must have valid admin credentials, to inject and execute arbitrary OS commands with root-level privileges through the web management interface. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with administrative access to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This can affect the confidentiality, integrity, and availability of the device and its managed network traffic.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit exposure of the device's management interface.