CVE-2026-71931: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorSwitch G2540xs

The vulnerability in DrayTek VigorSwitch G2540xs involves improper neutralization of special elements in the filename field used in the tftp_upgrade function. Because the filename is concatenated into an OS command without sufficient filtering, a remote attacker who has valid administrative credentials can supply crafted input to execute arbitrary OS commands with root privileges. This flaw is classified as OS command injection and affects multiple models of the VigorSwitch G2540xs. The CVSS 4.0 base score is 8.6, indicating high severity. No official remediation or patch information is currently provided.

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the device with root privileges, potentially leading to full system compromise. This can affect device integrity, confidentiality, and availability. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users or those who have compromised credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for unauthorized access attempts. No official patch or workaround has been documented at this time.