Threat database

CVE-2026-71923 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of username and password inputs in the auth_set function, allowing remote attackers with valid administrative credentials to execute arbitrary commands as root. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges to exploit.

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service.

CVE-2026-71921 is a critical pre-authentication OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It occurs in the setget.cgi interface due to insufficient filtering of the 'pass' field, allowing remote attackers to execute arbitrary commands with root privileges without authentication.

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to crash the service and cause a denial of service. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71918 is a command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from insufficient filtering of several input fields in the webBackupAction function, allowing remote attackers with valid administrative credentials to execute arbitrary commands as root. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71916 is a high-severity OS command injection vulnerability in DrayTek VigorSwitch G2540xs devices. It arises from improper filtering of special characters in the commandTable function, allowing remote attackers with valid administrative credentials to execute arbitrary commands with root privileges via the web management interface. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger this vulnerability via a crafted message to execute arbitrary commands with root privileges.

Multiple DrayTek VigorAP models, including the VigorAP 918R, have a command injection vulnerability in the upload_settings.cgi interface. This flaw arises from insufficient input filtering of the restorekey field before it is used in a shell command. An attacker with valid administrative credentials can exploit this vulnerability to execute arbitrary commands with root privileges on the device. The vulnerability does not require user interaction beyond authentication. No official patch or remediation guidance is currently available.

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

A buffer overflow vulnerability exists in the setLan function of DrayTek VigorAP 918R devices due to missing length checks during memory copy operations on certain LAN configuration fields. Exploitation requires valid administrative credentials and can lead to denial of service or arbitrary command execution.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71908 is a high-severity OS command injection vulnerability affecting multiple DrayTek VigorAP models, including the VigorAP 918R. The flaw exists in the mesh_start_speed_test function due to insufficient sanitization of the meshdevice_index and meshdevice_ip parameters. A remote attacker with valid administrative credentials to the device's web management interface can exploit this vulnerability to execute arbitrary commands with root privileges.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVE-2026-71906 is a high-severity OS command injection vulnerability in multiple DrayTek VigorAP models, including the VigorAP 918R. The flaw exists in the setLan function due to insufficient validation of the lanIp and lanNetmask fields before executing system commands. An attacker with valid administrative credentials on the device's web management interface can exploit this to execute arbitrary commands with root privileges.

CVE-2026-71905 is a command injection vulnerability in DrayTek VigorAP 918R devices. It affects the ExportSettings function due to insufficient filtering of certain input fields. An attacker with valid administrative credentials can execute arbitrary commands with root privileges on the device. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges.

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.