This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, where the tftp_upgrade function improperly neutralizes special elements in the filename input. Because the filename is concatenated directly into an OS command without adequate sanitization, a remote attacker who has valid admin credentials can inject and execute arbitrary commands on the device with root-level access. The vulnerability does not require user interaction beyond authentication and has a CVSS 4.0 score of 8.6, indicating high impact and exploitability under the given conditions.

Successful exploitation allows an authenticated attacker to execute arbitrary OS commands with root privileges on the affected device. This could lead to full compromise of the device, including unauthorized configuration changes, data theft, or disruption of network operations managed by the switch.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, ensure that administrative access to the device's web management interface is tightly controlled and limited to trusted personnel. Monitor for any vendor updates or security advisories regarding this vulnerability.