CVE-2026-71916

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-commandtable

Configurations

No configuration.

History

13 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Múltiples modelos de DrayTek VigorSwitch contienen una vulnerabilidad de inyección de comandos en la función commyTable. La vulnerabilidad es causada por un filtrado incompleto de caracteres peligrosos como comillas invertidas, caracteres de nueva línea y comillas simples en el campo de parámetro. Un atacante remoto puede activar esta vulnerabilidad mediante una entrada manipulada para ejecutar comandos arbitrarios con privilegios de root. La explotación requiere credenciales administrativas válidas para la interfaz de gestión web del dispositivo.

Information

Published : 2026-08-24 18:17

Updated : 2026-10-13 09:10

NVD link : CVE-2026-71916

Mitre link : CVE-2026-71916

CVE.ORG link : CVE-2026-71916

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-71916", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71916", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-27T13:48:55.498772Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "DrayTek Corporation", "product": "VigorSwitch G2540xs", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2540xs", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch FX2120", "versions": [{"status": "affected", "version": "0", "lessThan": "3.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2282x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2282x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch Q2300x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.10.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch PQ2300xb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.10.7", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2542x", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2542x", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2542xh", "versions": [{"status": "affected", "version": "0", "lessThan": "3.10.6", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch PX2060", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G1280", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P1280", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P1281x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G1282", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P1282", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2121", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2121", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch PQ2121x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch Q2121x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2280x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2280x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch Q2200x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch PQ2200xb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2100", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2100", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch G2540x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorSwitch P2540x", "versions": [{"status": "affected", "version": "0", "lessThan": "2.9.10", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T18:17:03.940", "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-os-command-injection-via-commandtable", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the commandTable function. The vulnerability is caused by incomplete filtering of dangerous characters such as backticks, newline characters, and single quotes in the parameter field. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface."}, {"lang": "es", "value": "M\u00faltiples modelos de DrayTek VigorSwitch contienen una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n commyTable. La vulnerabilidad es causada por un filtrado incompleto de caracteres peligrosos como comillas invertidas, caracteres de nueva l\u00ednea y comillas simples en el campo de par\u00e1metro. Un atacante remoto puede activar esta vulnerabilidad mediante una entrada manipulada para ejecutar comandos arbitrarios con privilegios de root. La explotaci\u00f3n requiere credenciales administrativas v\u00e1lidas para la interfaz de gesti\u00f3n web del dispositivo."}], "lastModified": "2026-10-13T09:10:00.323", "sourceIdentifier": "disclosure@vulncheck.com"}