CVE-2026-71926DrayTek VigorSwitch Multiple Models OS Command Injection via setDevice
Updated under an hour ago ()
Does this affect you?
It affects DrayTek Corporation VigorSwitch G2540xs and 27 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
DrayTek Corporation VigorSwitch G2540xs draytek:vigorswitch_g2540xs (from the name) | before 3.9.10 | CNA record |
DrayTek Corporation VigorSwitch P2540xs draytek:vigorswitch_p2540xs (from the name) | before 3.9.10 | CNA record |
DrayTek Corporation VigorSwitch FX2120 draytek:vigorswitch_fx2120 (from the name) | before 3.9.10 | CNA record |
DrayTek Corporation VigorSwitch G2282x draytek:vigorswitch_g2282x (from the name) | before 2.10.6 | CNA record |
DrayTek Corporation VigorSwitch P2282x draytek:vigorswitch_p2282x (from the name) | before 2.10.6 | CNA record |
DrayTek Corporation VigorSwitch Q2300x draytek:vigorswitch_q2300x (from the name) | before 2.10.7 | CNA record |
DrayTek Corporation VigorSwitch PQ2300xb draytek:vigorswitch_pq2300xb (from the name) | before 2.10.7 | CNA record |
DrayTek Corporation VigorSwitch G2542x draytek:vigorswitch_g2542x (from the name) | before 3.10.6 | CNA record |
DrayTek Corporation VigorSwitch P2542x draytek:vigorswitch_p2542x (from the name) | before 3.10.6 | CNA record |
DrayTek Corporation VigorSwitch P2542xh draytek:vigorswitch_p2542xh (from the name) | before 3.10.6 | CNA record |
DrayTek Corporation VigorSwitch PX2060 draytek:vigorswitch_px2060 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G1280 draytek:vigorswitch_g1280 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P1280 draytek:vigorswitch_p1280 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P1281x draytek:vigorswitch_p1281x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G1282 draytek:vigorswitch_g1282 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P1282 draytek:vigorswitch_p1282 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G2121 draytek:vigorswitch_g2121 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P2121 draytek:vigorswitch_p2121 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch PQ2121x draytek:vigorswitch_pq2121x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch Q2121x draytek:vigorswitch_q2121x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G2280x draytek:vigorswitch_g2280x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P2280x draytek:vigorswitch_p2280x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch Q2200x draytek:vigorswitch_q2200x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch PQ2200xb draytek:vigorswitch_pq2200xb (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G2100 draytek:vigorswitch_g2100 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P2100 draytek:vigorswitch_p2100 (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch G2540x draytek:vigorswitch_g2540x (from the name) | before 2.9.10 | CNA record |
DrayTek Corporation VigorSwitch P2540x draytek:vigorswitch_p2540x (from the name) | before 2.9.10 | CNA record |
References
- https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/vendor-advisory
- https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-setdevicethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.