The vulnerability CVE-2026-71918 affects DrayTek VigorSwitch G2540xs models and involves improper neutralization of special elements in the webBackupAction function. Specifically, the option, key, pw_encode, pathN, and valueN fields are not properly filtered before being used in OS command execution. This flaw enables a remote attacker, who must have valid administrative credentials for the device's web management interface, to execute arbitrary commands with root privileges. The CVSS 4.0 score is 8.6, indicating high severity. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands as root on the affected device, potentially leading to full system compromise. Since administrative credentials are required, the risk is limited to attackers who have already gained elevated access, but the impact at that level is severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for unauthorized access attempts. Avoid exposing the device's web management interface to untrusted networks.