This vulnerability in DrayTek VigorSwitch G2540xs involves improper neutralization of special elements used in OS commands within the auth_set function. Because the username and password inputs are not adequately sanitized before command execution, an attacker who has valid admin credentials can inject malicious commands remotely, leading to root-level command execution on the device.

An attacker with valid administrative credentials can execute arbitrary OS commands with root privileges on the affected device. This could lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of network operations. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. No official fix or temporary workaround has been documented in the provided data.