This vulnerability affects multiple DrayTek VigorSwitch models, specifically the VigorSwitch G2540xs. The root cause is improper neutralization of special elements in the rebDevice function, which processes username and password inputs without adequate sanitization before executing OS commands. An attacker who has valid admin credentials can exploit this flaw remotely through crafted input to execute arbitrary commands as root, potentially compromising the device and network. The CVSS 4.0 score is 8.6, reflecting high impact and ease of exploitation given administrative access. No patch or official remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, unauthorized control over network traffic, and potential lateral movement within the network environment. The vulnerability requires no user interaction beyond valid credentials and can be triggered remotely via the web management interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit access to the device's management interface. Monitor vendor communications for updates on patches or mitigations.