CVE-2026-71923: DrayTek VigorSwitch Command Injection Vulnerability

CVE-2026-71923 Overview

CVE-2026-71923 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorSwitch models. The flaw resides in the auth_set function, which fails to properly filter the username and password fields before passing them to a shell command. An authenticated attacker with administrative credentials on the device's web management interface can inject arbitrary commands. Successful exploitation grants code execution with root privileges on the affected switch.

Critical Impact
A remote authenticated administrator can execute arbitrary commands as root on affected DrayTek VigorSwitch devices, leading to full device compromise, persistent network foothold, and pivoting into internal segments.

Affected Products

Multiple DrayTek VigorSwitch series models (see vendor advisory)
Devices exposing the web management interface with default or attacker-known administrative credentials
Refer to the DrayTek Security Advisory for the full model and firmware matrix

Discovery Timeline

2026-08-24 - CVE-2026-71923 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71923

Vulnerability Analysis

The vulnerability lives in the auth_set function of the VigorSwitch web management application. The function receives credential fields from HTTP requests and concatenates them into a shell command without sanitization. Shell metacharacters supplied in the username or password parameter break out of the intended argument context and execute attacker-controlled commands. Because the web management daemon runs as root, injected commands inherit root privileges.

The attack is network-reachable and requires no user interaction. Exploitation does require valid administrative credentials, which raises the bar but does not eliminate risk. Credentials are often shared, reused, or exposed through prior breaches, phishing, and default password use on network appliances.

Successful exploitation enables firmware modification, credential theft, traffic interception through port mirroring, and installation of persistent implants. Attackers who compromise a managed switch can pivot laterally across VLANs and observe or alter east-west traffic.

Root Cause

The root cause is missing input validation and unsafe construction of shell commands inside auth_set. User-controllable strings reach a command interpreter without escaping, quoting, or allow-list filtering. This matches the pattern described in CWE-78: Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

An attacker authenticates to the VigorSwitch web management interface using valid administrative credentials. The attacker then submits a crafted request to the endpoint backed by auth_set, embedding shell metacharacters such as backticks, $(), or ; inside the username or password field. The injected payload executes as root on the underlying operating system.

See the VulnCheck Advisory on DrayTek Vulnerabilities for additional technical context. No public proof-of-concept exploit is currently listed for this CVE.

Detection Methods for CVE-2026-71923

Indicators of Compromise

Authentication or configuration requests to the VigorSwitch web interface containing shell metacharacters such as ;, &&, |, `, or $() within the username or password fields
Outbound connections from the switch's management IP to unexpected destinations, including reverse shells or downloader URLs
Unexpected new files, cron entries, or startup scripts on the device following administrative logins
Configuration changes, firmware writes, or port-mirroring changes that do not match approved change tickets

Detection Strategies

Inspect web management access logs for administrative POST requests whose parameter values contain shell metacharacters or encoded equivalents.
Alert on any egress traffic sourced from switch management interfaces to non-management destinations such as public IPs or arbitrary internal hosts.
Correlate administrative logins with subsequent configuration or firmware changes and flag mismatches.
Compare running firmware hashes and configuration snapshots against a known-good baseline on a scheduled cadence.

Monitoring Recommendations

Forward switch syslog, authentication events, and configuration change logs to a centralized SIEM for retention and correlation.
Monitor administrative account usage on network appliances, including source IPs, session times, and failed login patterns.
Track DNS queries and connection attempts originating from management VLANs to detect command-and-control activity from compromised infrastructure.

How to Mitigate CVE-2026-71923

Immediate Actions Required

Apply the firmware update referenced in the DrayTek Security Advisory to every affected VigorSwitch model.
Restrict access to the web management interface to a dedicated management VLAN and a short allow-list of administrator workstations.
Rotate all administrative credentials on VigorSwitch devices and disable any shared or default accounts.
Audit recent administrative sessions and configuration changes on affected switches for signs of exploitation.

Patch Information

DrayTek has published fixed firmware for the affected VigorSwitch series. Refer to the DrayTek Security Advisory for model-specific firmware versions and download instructions. Patched firmware adds input validation on the username and password fields consumed by auth_set.

Workarounds

Block access to the switch's HTTP and HTTPS management ports from all networks except a hardened management subnet.
Enforce strong, unique administrative passwords and enable multi-factor access controls at the network layer where the device itself lacks MFA.
Disable remote management from WAN interfaces if it is not required for operations.
Place switch management interfaces behind a jump host that logs all administrative sessions.

bash

# Example ACL concept: restrict management access to a bastion subnet only
# Replace 10.10.50.0/24 with your management network
access-list MGMT permit tcp 10.10.50.0/24 host <switch-mgmt-ip> eq 443
access-list MGMT deny   tcp any host <switch-mgmt-ip> eq 443
access-list MGMT deny   tcp any host <switch-mgmt-ip> eq 80