CVE-2026-71921: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, where the setget.cgi interface improperly neutralizes special elements in the 'pass' parameter before executing system commands. This flaw enables a remote attacker to inject and execute arbitrary OS commands with root-level privileges without requiring authentication, posing a severe security risk. The CVSS 4.0 base score is 9.3, reflecting its critical impact and ease of exploitation. No patch or official remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows a remote attacker to execute arbitrary commands on the affected device with root privileges without any authentication, potentially leading to full system compromise, disruption of network operations, or unauthorized control over the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the setget.cgi interface from untrusted networks and monitor for suspicious activity targeting this interface.