CVE-2026-71918: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, due to improper neutralization of special elements in the webBackupAction function. The affected fields include option, key, pw_encode, pathN, and valueN, which are not properly sanitized before being used in OS command execution. An attacker with valid administrative credentials to the device's web management interface can exploit this flaw to execute arbitrary commands with root privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no user interaction, and high privileges required, with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of network operations. However, exploitation requires valid administrative credentials, limiting the attack surface to credentialed users.

No official patch or remediation guidance is currently available from the vendor. Administrators should restrict administrative access to trusted users only and monitor for any suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.