CVE-2026-71925: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, due to improper neutralization of special elements in the getDetail function. The flaw allows an attacker who has valid admin credentials to inject OS commands by supplying crafted input in the username and password fields. Successful exploitation results in arbitrary command execution with root-level privileges on the device. The vulnerability does not require user interaction beyond credential use and has a CVSS 4.0 base score of 8.6, indicating high severity. No patch or official remediation guidance is currently available, and no known exploits are reported in the wild.

An attacker with valid administrative credentials can execute arbitrary OS commands with root privileges on affected DrayTek VigorSwitch G2540xs devices. This could lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of network operations managed by the switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity. Since exploitation requires valid admin credentials, enforcing strong authentication and limiting credential exposure is critical.