This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs. The root cause is insufficient sanitization of special elements in the username and password fields before they are used in OS command execution within the fdftDevice function. An attacker who has valid administrative credentials can exploit this flaw remotely through crafted input to execute arbitrary commands with root privileges on the device. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no user interaction required, but requiring high privileges (administrative credentials). No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands as root, potentially leading to full device compromise, unauthorized control, and disruption of network operations managed by the affected switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Since exploitation requires valid administrative credentials, enforcing strong authentication and limiting credential exposure is critical.