This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, where the setTime function does not properly neutralize special elements in the username and password inputs before executing OS commands. An attacker who has valid admin credentials can exploit this flaw to run arbitrary commands as root on the device, potentially compromising the system fully. The vulnerability has a CVSS 4.0 score of 8.6, indicating high severity. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full system compromise, unauthorized control, and potential disruption of network operations managed by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Since exploitation requires valid admin credentials, enforcing strong authentication and access controls is critical.