CVE-2026-71915: DrayTek VigorSwitch RCE Vulnerability

CVE-2026-71915 Overview

CVE-2026-71915 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorSwitch models. The flaw resides in the jsonstatus function of the device's web management interface. Insufficient filtering of the usescript, usefile, and option fields allows attacker-controlled input to reach command execution. A remote authenticated attacker with administrative credentials can execute arbitrary commands as root. Successful exploitation results in full compromise of the switch, including confidentiality, integrity, and availability of the device.

Critical Impact
Authenticated remote attackers can execute arbitrary OS commands with root privileges on affected DrayTek VigorSwitch devices, resulting in complete device takeover.

Affected Products

DrayTek VigorSwitch series (multiple models, August 2026 advisory)
Devices exposing the web management interface with the vulnerable jsonstatus handler
Refer to the DrayTek Security Advisory for the complete model and firmware list

Discovery Timeline

2026-08-24 - CVE-2026-71915 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71915

Vulnerability Analysis

The vulnerability exists in the jsonstatus handler exposed by the VigorSwitch web management interface. This handler accepts several parameters, including usescript, usefile, and option, and passes them into a system command execution path without adequate sanitization. Because the web server on the switch runs with root privileges, injected shell metacharacters execute in the same privileged context.

The issue is classified as OS Command Injection [CWE-78]. Exploitation requires valid administrative credentials for the web interface, but no additional user interaction is needed. An EPSS score of 3.05% at the 86th percentile indicates a meaningfully elevated likelihood of exploitation attempts relative to the broader CVE population.

Root Cause

The jsonstatus function concatenates the usescript, usefile, and option fields into a shell command string before invoking a system-level executor. Input validation and shell metacharacter escaping are absent. Any authenticated user able to reach the endpoint can inject shell operators such as ;, |, &&, or command substitution to break out of the intended command context.

Attack Vector

The attack vector is network-based against the switch's HTTP or HTTPS management interface. An attacker first authenticates with valid administrative credentials, typically obtained through credential reuse, phishing, default credentials, or a prior compromise. The attacker then issues a crafted request to the jsonstatus endpoint with malicious content in usescript, usefile, or option. The injected commands run as root, enabling firmware modification, credential extraction from configuration files, lateral movement into management VLANs, and persistent implants on the switch.

No verified public exploit code is available at time of publication. See the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-71915

Indicators of Compromise

Unexpected HTTP or HTTPS POST requests to the jsonstatus endpoint containing shell metacharacters (;, |, `, $()) in the usescript, usefile, or option parameters
New or modified accounts, SSH keys, or startup scripts on the switch appearing outside change windows
Outbound connections from the switch management IP to unfamiliar external hosts
Configuration files with unexpected commands, cron entries, or reverse-shell payloads

Detection Strategies

Inspect web-server access logs on the switch for requests to jsonstatus referencing usescript, usefile, or option with non-standard values
Deploy network intrusion detection signatures that flag shell metacharacters in HTTP request bodies destined for VigorSwitch management interfaces
Baseline normal administrative traffic to management interfaces and alert on deviations in source IPs, user agents, or request patterns

Monitoring Recommendations

Forward switch management logs and authentication events to a centralized SIEM for correlation with endpoint and identity telemetry
Monitor administrative logins to VigorSwitch devices for anomalies including off-hours activity and geographically improbable sources
Alert on any firmware or configuration change events on network infrastructure and require out-of-band verification

How to Mitigate CVE-2026-71915

Immediate Actions Required

Apply the firmware update referenced in the DrayTek Security Advisory for each affected VigorSwitch model
Rotate all administrative credentials for VigorSwitch devices and disable any unused administrative accounts
Restrict access to the web management interface to a dedicated management network or jump host and block it from untrusted networks
Audit switch configurations, user accounts, and scheduled tasks for signs of unauthorized modification

Patch Information

DrayTek has published firmware updates addressing this vulnerability as part of the August 2026 VigorSwitch security advisory. Consult the DrayTek Security Advisory for the specific firmware versions per model and installation guidance. Apply the patch to all VigorSwitch devices in the affected model list.

Workarounds

Block network access to the web management interface from all networks except an isolated management segment
Disable HTTP or HTTPS management and rely on out-of-band console access where operationally feasible
Enforce strong, unique administrative credentials and enable multi-factor authentication on any jump hosts used to reach the switch
Place VigorSwitch management interfaces behind a firewall rule set that permits only known administrator source addresses

bash

# Configuration example: restrict switch management access at the upstream firewall
# Replace the placeholders with your management subnet and switch IP
iptables -A FORWARD -s 10.10.20.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80  -j DROP