This vulnerability affects multiple DrayTek VigorSwitch models, specifically the G2540xs, due to improper neutralization of special elements in the setDevNet function. The flaw allows an attacker who has valid admin credentials on the device's web management interface to inject OS commands by supplying crafted input in the username and password fields. Successful exploitation results in arbitrary command execution with root privileges. The CVSS 4.0 base score is 8.6, indicating high severity. There is no vendor advisory or patch information available at this time.

An attacker with valid administrative access can execute arbitrary OS commands with root privileges on the affected device, potentially leading to full system compromise. This elevates the risk of unauthorized control, data manipulation, or disruption of network operations managed by the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity. Avoid exposing the device's management interface to untrusted networks.