CVE-2026-71921 Overview
CVE-2026-71921 is a pre-authentication command injection vulnerability affecting multiple DrayTek VigorSwitch models. The flaw resides in the setget.cgi interface, where the pass field is insufficiently filtered before being passed to a command execution context. A remote, unauthenticated attacker can send crafted input to execute arbitrary operating system commands with root privileges on the affected switch. The issue is tracked under CWE-78, Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
Unauthenticated remote attackers can execute arbitrary commands as root on affected DrayTek VigorSwitch devices, resulting in full device compromise.
Affected Products
- Multiple DrayTek VigorSwitch series models (see vendor advisory for the complete model and firmware list)
- Devices exposing the setget.cgi management interface
- Management interfaces reachable from untrusted networks
Discovery Timeline
- 2026-08-24 - CVE-2026-71921 published to the National Vulnerability Database (NVD)
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-71921
Vulnerability Analysis
The vulnerability is a pre-authentication OS command injection reachable through the setget.cgi handler on the switch's web management interface. The handler processes HTTP requests before authentication is enforced, exposing the parser to unauthenticated network clients. The pass parameter is incorporated into a shell command without sufficient neutralization of shell metacharacters. Because the resulting command runs in the context of the switch's root-level management daemon, successful exploitation grants full control of the device. An attacker can pivot into the internal network segment served by the switch, modify VLAN and port configuration, mirror traffic, or persist malicious firmware modifications.
Root Cause
The root cause is insufficient input filtering on the pass field consumed by setget.cgi. The value flows into a command interpreter without argument-safe execution primitives or an allow-list of permitted characters. This is a classic CWE-78 pattern: user-controlled data concatenated into a shell string.
Attack Vector
Exploitation is remote and network-based. The attacker sends a crafted HTTP request to the setget.cgi endpoint containing shell metacharacters in the pass field. No credentials, user interaction, or prior foothold are required. Because the command executes as root, the attacker gains the highest privilege available on the switch operating system. Full technical details are available in the DrayTek Security Advisory and the VulnCheck Advisory on DrayTek.
No verified public proof-of-concept code is referenced in the CVE record. See the vendor and VulnCheck advisories for reproduction details.
Detection Methods for CVE-2026-71921
Indicators of Compromise
- Unexpected HTTP POST or GET requests to /setget.cgi from external or unmanaged internal hosts.
- Requests containing shell metacharacters such as ;, |, `, $(, or && in the pass parameter.
- New, unexplained processes spawned by the switch web server or management daemon.
- Unauthorized configuration changes, new administrative accounts, or firmware image modifications on the switch.
Detection Strategies
- Inspect web server and management-plane logs on VigorSwitch devices for requests to setget.cgi that include non-alphanumeric characters in the pass field.
- Deploy network intrusion detection signatures that flag HTTP requests to setget.cgi containing shell metacharacters.
- Correlate management-interface access with source IP reputation; alert on connections from non-management VLANs.
Monitoring Recommendations
- Forward switch syslog and web-management logs to a centralized SIEM or data lake for retention and correlation.
- Baseline normal administrative traffic to VigorSwitch devices and alert on deviations in request paths and parameter contents.
- Monitor outbound connections initiated by switch management IPs, which may indicate post-exploitation callbacks.
How to Mitigate CVE-2026-71921
Immediate Actions Required
- Apply the firmware updates listed in the DrayTek Security Advisory as soon as available for each affected model.
- Remove VigorSwitch management interfaces from the public internet and restrict access to a dedicated management VLAN.
- Rotate administrative credentials and inspect device configuration for unauthorized changes after patching.
- Audit firmware integrity on any device that was reachable from untrusted networks prior to patching.
Patch Information
DrayTek has published fixed firmware for the affected VigorSwitch series in its August 2026 advisory. Administrators should consult the DrayTek Security Advisory for the specific model-to-firmware mapping and follow the vendor's documented upgrade procedure. The VulnCheck Advisory on DrayTek provides additional context on affected builds.
Workarounds
- Restrict TCP access to the switch web management interface using upstream firewall or ACL rules that permit only trusted management hosts.
- Disable remote management on the WAN or untrusted interfaces where the device supports that option.
- Place VigorSwitch management interfaces behind a VPN or jump host until patching is complete.
# Example ACL restricting HTTP/HTTPS management access to a trusted subnet
# Adjust interface names, ACL syntax, and management subnet to your environment
access-list MGMT_ONLY permit tcp 10.10.0.0 0.0.0.255 host <switch_ip> eq 80
access-list MGMT_ONLY permit tcp 10.10.0.0 0.0.0.255 host <switch_ip> eq 443
access-list MGMT_ONLY deny tcp any host <switch_ip> eq 80
access-list MGMT_ONLY deny tcp any host <switch_ip> eq 443
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
