CVE-2026-71928: DrayTek VigorSwitch RCE Vulnerability

CVE-2026-71928 Overview

CVE-2026-71928 is a command injection vulnerability affecting multiple DrayTek VigorSwitch models. The flaw resides in the fdftDevice function, which fails to sanitize input received in the username and password fields before passing values to command execution routines. An authenticated remote attacker with administrative access to the web management interface can inject shell metacharacters into these fields to execute arbitrary commands with root privileges on the underlying operating system. The vulnerability is tracked under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Successful exploitation grants root-level command execution on affected DrayTek VigorSwitch devices, allowing full compromise of the switch and pivoting into segmented network zones.

Affected Products

DrayTek VigorSwitch series (multiple models — refer to vendor advisory for exact firmware versions)
Devices exposing the web management interface where the fdftDevice function processes authentication input
Deployments where administrative credentials are shared, weak, or exposed

Discovery Timeline

2026-08-24 - CVE-2026-71928 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71928

Vulnerability Analysis

The vulnerability exists in the fdftDevice function, which handles device management logic on affected DrayTek VigorSwitch firmware. When processing the username and password parameters submitted through the web management interface, the function concatenates the values into an operating system command string without applying input filtering or shell-safe escaping.

An attacker who supplies shell metacharacters — for example, backticks, semicolons, or command substitution sequences — inside either field causes the underlying shell to interpret the injected payload. Commands execute in the context of the switch's root process, giving the attacker full control of the device.

Exploitation requires valid administrative credentials for the web interface. This authentication requirement reduces the pool of remote attackers but does not eliminate the risk. Credential reuse, phishing, default credentials on unhardened deployments, and post-compromise lateral movement all create realistic paths to abuse. The current EPSS probability sits at 1.67 percent, in the 75th percentile of scored CVEs.

Root Cause

The root cause is missing input validation on user-supplied authentication fields. The fdftDevice function trusts credential parameters and passes them into a command execution primitive without allowlisting characters or using parameterized process invocation. Any string that reaches the shell interpreter is executed verbatim.

Attack Vector

The attack vector is network-based against the switch's HTTP or HTTPS management interface. An authenticated administrator sends a crafted request containing shell metacharacters in the username or password field. The switch executes the injected commands as root, enabling firmware modification, credential extraction, packet capture, and persistence.

No verified public exploit code is available at the time of publication. For technical details, refer to the DrayTek Security Advisory and the VulnCheck advisory.

Detection Methods for CVE-2026-71928

Indicators of Compromise

Web management access logs containing shell metacharacters (;, |, &, `, $() inside the username or password POST parameters
Unexpected outbound connections originating from the switch management IP, particularly to attacker infrastructure or DNS resolvers not defined in configuration
New or modified files on the switch filesystem, unexpected process trees spawned by the web server, or configuration changes without a corresponding administrator session

Detection Strategies

Deploy network intrusion detection signatures that flag HTTP POST bodies to switch management endpoints containing shell metacharacters in credential fields
Forward VigorSwitch syslog and authentication logs to a central SIEM and correlate failed and successful logins with subsequent command execution events
Baseline expected administrative behavior for each switch and alert on deviations such as off-hours logins, new source IPs, or bursts of configuration changes

Monitoring Recommendations

Restrict management access to a dedicated out-of-band VLAN and monitor that segment with full packet capture
Alert on any HTTP or HTTPS request to switch management interfaces sourced from user or server subnets
Track firmware version and configuration hash for each VigorSwitch and alert on unexpected changes

How to Mitigate CVE-2026-71928

Immediate Actions Required

Apply the firmware update listed in the DrayTek Security Advisory for every affected VigorSwitch model
Rotate all administrative credentials on affected switches after patching, and remove any shared or default accounts
Remove exposure of switch management interfaces from untrusted networks and the public internet

Patch Information

DrayTek has published fixed firmware for the affected VigorSwitch models in the August 2026 security advisory. Administrators should review the vendor bulletin for the exact fixed firmware version corresponding to each hardware model and schedule upgrades on all in-scope devices. Cross-reference the VulnCheck advisory for additional affected model coverage.

Workarounds

Bind the web management interface to a management VLAN reachable only from a hardened jump host
Enforce strong, unique administrator passwords and enable account lockout to reduce credential compromise risk
Disable the HTTP or HTTPS management service where CLI or SNMP-based administration is sufficient
Place switch management IPs behind an access control list that permits only authorized administrator source addresses

bash

# Example: restrict VigorSwitch management access to a single admin subnet
# (adapt to the specific ACL syntax of your VigorSwitch firmware)
configure terminal
access-list management permit 10.10.50.0/24
access-list management deny any
interface management
  ip access-group management in
end
write memory