Critical OS Command Injection in DrayTek VigorSwitch

DrayTek has disclosed a critical command injection vulnerability, identified as CVE-2026-71921, affecting multiple models within the VigorSwitch series. The vulnerability is located in the setget.cgi interface, which fails to properly sanitize the 'pass' parameter before passing it to an underlying system process. An unauthenticated remote attacker can exploit this flaw by sending a crafted HTTP request containing shell metacharacters, leading to arbitrary command execution with root-level privileges on the affected networking equipment. Given that these devices often operate at the perimeter or core of internal networks, successful exploitation grants the attacker persistent control over the network infrastructure. Defenders should prioritize updating firmware for all affected VigorSwitch units listed below.

Impact

Successful exploitation of CVE-2026-71921 results in complete system compromise, allowing an attacker to gain root access to the affected switch. This facilitates unauthorized network traffic interception, pivoting into internal network segments, or the installation of persistent backdoors on the device. Numerous models are impacted, spanning various firmware versions, creating a widespread exposure for organizations utilizing DrayTek infrastructure.

Recommendation

• Immediately update firmware on all affected DrayTek VigorSwitch models to the non-vulnerable versions specified in the vendor security advisory.
• Apply access control lists (ACLs) to restrict management interface access (setget.cgi) to trusted internal management subnets only.
• Deploy the Sigma rule provided below to identify exploitation attempts targeting the setget.cgi interface via web logs.