CVE-2026-71919 Overview
CVE-2026-71919 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorSwitch models. The flaw resides in the sysreboot function of the device's web management interface. Insufficient filtering of the config, act, pathN, and valueN parameters allows attacker-controlled input to reach a shell context. A remote authenticated attacker with administrative credentials can execute arbitrary commands as root on the switch. Successful exploitation delivers full control of the affected device, including its network traffic and management plane.
Critical Impact
Authenticated attackers can execute arbitrary commands with root privileges on affected DrayTek VigorSwitch devices, compromising confidentiality, integrity, and availability of the switch and connected network segments.
Affected Products
- DrayTek VigorSwitch series (multiple models, see vendor advisory)
- Devices running vulnerable firmware exposing the sysreboot web management function
- Any VigorSwitch deployment where the web management interface is reachable by untrusted networks
Discovery Timeline
- 2026-08-24 - CVE-2026-71919 published to the National Vulnerability Database (NVD)
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-71919
Vulnerability Analysis
The vulnerability is a classic OS command injection in the switch's web management backend. The sysreboot handler accepts several request fields, including config, act, pathN, and valueN, and passes their contents into a shell execution path without adequate sanitization or safe API usage. Because the underlying execution runs as root, injected commands inherit full system privileges.
Exploitation requires valid administrative credentials for the web management interface, which raises the required privilege but does not require user interaction. Any legitimate administrator credential, whether obtained via phishing, credential reuse, or a prior compromise, converts directly into remote code execution on the switch.
Once code execution is achieved, an attacker can persist on the device, tamper with configuration, mirror traffic, pivot into internal networks, or brick the appliance. Because network switches sit at a trust boundary, compromise here materially increases the blast radius of any intrusion.
Root Cause
The root cause is insufficient input filtering before command execution in the sysreboot function. User-controllable request fields are concatenated into a shell command rather than being passed as isolated arguments to a safe execution API. Shell metacharacters in the config, act, pathN, or valueN parameters are interpreted by the shell instead of being treated as literal data.
Attack Vector
The attack vector is network-based against the web management interface. An attacker who has obtained administrator credentials sends a crafted HTTP request to the sysreboot endpoint with shell metacharacters embedded in one of the vulnerable parameters. The switch invokes the shell, executes the injected commands as root, and returns control of the underlying operating system to the attacker.
No verified public exploit code is available at time of writing. For technical specifics, refer to the DrayTek Security Advisory and the VulnCheck DrayTek Advisory.
Detection Methods for CVE-2026-71919
Indicators of Compromise
- HTTP requests to the switch web management interface targeting the sysreboot handler that contain shell metacharacters (;, |, &, `, $() within the config, act, pathN, or valueN fields.
- Unexpected outbound connections initiated by the switch to attacker-controlled infrastructure following administrative sessions.
- Configuration changes, new administrative users, or unexpected reboots on VigorSwitch devices without a corresponding change ticket.
Detection Strategies
- Inspect web server and management-plane logs on VigorSwitch devices for POST requests to sysreboot containing non-alphanumeric characters in the affected parameters.
- Alert on administrative logins to VigorSwitch web interfaces from unusual source addresses or outside change windows.
- Correlate switch reboots with the source IP of the preceding administrative session to spot anomalous reboot triggers.
Monitoring Recommendations
- Forward VigorSwitch syslog and web management audit logs to a centralized logging platform for retention and correlation.
- Monitor management VLAN traffic for HTTP requests to /sysreboot or equivalent endpoints from hosts other than approved management stations.
- Baseline normal administrative behavior and alert on deviations such as off-hours logins or rapid configuration changes.
How to Mitigate CVE-2026-71919
Immediate Actions Required
- Restrict access to the VigorSwitch web management interface to a dedicated management network or jump host, and block it from user and internet-facing segments.
- Rotate all administrative credentials on affected switches and enforce strong, unique passwords.
- Audit VigorSwitch devices for unauthorized configuration changes, unknown accounts, and unexpected firmware states.
- Apply the firmware update published in the DrayTek Security Advisory as soon as it is available for the affected model.
Patch Information
DrayTek has published a security advisory covering multiple vulnerabilities in the VigorSwitch series, including CVE-2026-71919. Consult the DrayTek Security Advisory for the list of affected models and fixed firmware versions, and the VulnCheck DrayTek Advisory for additional technical context. Upgrade each device to the vendor-specified fixed firmware release.
Workarounds
- Disable remote (WAN-side) access to the web management interface and permit management only from a restricted internal subnet.
- Place VigorSwitch management interfaces behind a firewall access control list that allows only known administrator hosts.
- Require multi-factor authentication and privileged access management for administrators before granting access to switch management networks.
- Disable unused management protocols and services on the switch to reduce the exposed attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
