This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs. The root cause is improper neutralization of special elements in the setDevProto function, which processes username and password inputs without adequate filtering before executing OS commands. An attacker who has valid admin credentials to the device's web management interface can exploit this flaw to run arbitrary commands as root, potentially compromising the device fully. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required but with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full device compromise, including unauthorized control, data manipulation, or disruption of network operations managed by the switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device management interface.