CVE-2026-71921
CriticalCVSS 9.8Summary
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.
Risk Assessment
An unauthenticated attacker can gain full control of the device by executing arbitrary commands with administrator privileges, potentially leading to complete device and network compromise.
Recommendation
Update DrayTek VigorSwitch firmware to the latest version that includes input filtering fixes.
Original NVD description (English source)
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.