CVE-2026-71926: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, due to improper neutralization of special elements in the setDevice function. The flaw allows an attacker who has valid admin credentials on the device's web management interface to inject and execute OS commands with root privileges by supplying crafted input in the username, password, or location fields. The CVSS 4.0 score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required. There is no vendor advisory or patch information provided at this time.

An attacker with valid administrative access can execute arbitrary OS commands with root privileges on the affected device, potentially leading to full system compromise. This could allow unauthorized control over the device, impacting network infrastructure managed by the switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. No vendor-provided mitigation or temporary fix is currently documented.