CVE-2026-71919: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs. The issue lies in the sysreboot function where the config, act, pathN, and valueN fields are not properly sanitized before being used in OS command execution. An attacker who has valid administrative credentials on the device's web interface can exploit this flaw to execute arbitrary commands with root privileges, potentially compromising the device fully. The CVSS 4.0 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full system compromise, unauthorized control, and potential disruption of network operations managed by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. No official fix or temporary workaround has been documented in the provided data.