CVE-2026-71928: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs. The root cause is improper neutralization of special elements in the username and password fields before these inputs are used in OS command execution within the fdftDevice function. An attacker who has valid administrative credentials to the device's web management interface can exploit this flaw to execute arbitrary commands with root-level privileges on the device. The CVSS 4.0 score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, potentially impacting network infrastructure managed by the switch. However, exploitation requires valid admin credentials, limiting the attack surface to authorized users or those who have obtained such credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unauthorized access attempts. No official fix or temporary mitigation has been published by the vendor at this time.