Threat database

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulnerability is caused by insufficient validation of the option field. A remote attacker can trigger this vulnerability via crafted input containing path traversal sequences to access arbitrary files on the device. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71931 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient input filtering in the tftp_upgrade function, allowing an attacker with valid administrative credentials to execute arbitrary commands with root privileges via crafted input. This vulnerability requires authenticated access to the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setTime function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71928 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of username and password fields in the fdftDevice function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges (admin access). No patch or official remediation information is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71926 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient sanitization of username, password, and location fields in the setDevice function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71923 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of username and password inputs in the auth_set function, allowing remote attackers with valid administrative credentials to execute arbitrary commands as root. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges to exploit.

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.

CVE-2026-71921 is a critical pre-authentication OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It occurs in the setget.cgi interface due to insufficient filtering of the 'pass' field, allowing remote attackers to execute arbitrary commands with root privileges without authentication.

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71918 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of several input fields in the webBackupAction function, allowing remote attackers with valid administrative credentials to execute arbitrary commands as root. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71916 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from improper filtering of special characters in the commandTable function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges via the web management interface. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger this vulnerability via a crafted message to execute arbitrary commands with root privileges.

Multiple DrayTek VigorAP models, including the VigorAP 918R, have a command injection vulnerability in the upload_settings.cgi interface. This flaw arises from insufficient input filtering of the restorekey field before it is used in a shell command. An attacker with valid administrative credentials can exploit this vulnerability to execute arbitrary commands with root privileges on the device. The vulnerability does not require user interaction beyond authentication. No official patch or remediation guidance is currently available.