CVE-2026-71924: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, where the getVid function does not properly neutralize special elements in the username and password fields before executing OS commands. An attacker who has valid admin credentials can exploit this flaw to run arbitrary commands on the device with root-level access. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of network operations managed by the switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Since exploitation requires valid admin credentials, enforcing strong authentication and limiting access to the management interface can reduce risk.