CVE-2026-71929: DrayTek VigorSwitch RCE Vulnerability

CVE-2026-71929 Overview

CVE-2026-71929 is a command injection vulnerability affecting multiple DrayTek VigorSwitch models. The flaw resides in the setDevProto function, which fails to filter the username and password fields before passing them to command execution. A remote attacker with valid administrative credentials for the web management interface can inject arbitrary operating system commands. The injected commands execute with root privileges, giving the attacker full control over the affected switch. The vulnerability is tracked under CWE-78: OS Command Injection.

Critical Impact
Authenticated attackers can execute arbitrary commands as root on affected VigorSwitch devices, resulting in complete compromise of network switching infrastructure.

Affected Products

Multiple DrayTek VigorSwitch series models (see vendor advisory for the complete list)
Web management interface of affected VigorSwitch firmware
Devices exposing administrative interfaces to reachable networks

Discovery Timeline

2026-08-24 - CVE-2026-71929 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71929

Vulnerability Analysis

The vulnerability exists in the setDevProto handler exposed by the VigorSwitch web management interface. The handler accepts username and password parameters and incorporates them into a shell command without adequate sanitization or argument separation. An authenticated administrator can supply shell metacharacters in either field to break out of the intended command context.

Because the affected process runs as root, injected payloads inherit full privileges on the underlying operating system. This enables attackers to read arbitrary files, modify device configuration, pivot into internal networks, or install persistent backdoors on the switch firmware. Exploitation is network-reachable and requires no user interaction beyond an authenticated session.

The EPSS model estimates a 3.05% probability of exploitation within 30 days, placing this issue in the 86th percentile of CVEs tracked by the model.

Root Cause

The root cause is insufficient input filtering on user-controlled fields before they are concatenated into a shell command. The setDevProto function trusts credential fields as opaque strings and passes them to a system-level command interpreter. Standard shell metacharacters such as ;, |, &&, and backticks are not escaped or rejected, so the field values are interpreted as command syntax rather than data.

Attack Vector

Exploitation requires valid administrative credentials for the switch's web management interface. Once authenticated, the attacker submits a crafted request to the endpoint backed by setDevProto with shell metacharacters embedded in the username or password parameter. The device then executes the injected commands as root during processing of the request. This attack path is often reached by attackers who have already obtained administrative credentials through phishing, credential reuse, or default-credential exposure.

See the DrayTek Security Advisory and VulnCheck DrayTek OS Command Injection writeups for endpoint-specific technical details.

Detection Methods for CVE-2026-71929

Indicators of Compromise

Unexpected outbound connections originating from VigorSwitch management interfaces
Web server access logs showing POST requests to the setDevProto endpoint containing shell metacharacters in username or password fields
Unauthorized configuration changes, new administrative accounts, or unexplained firmware modifications on the switch
Root-owned processes on the switch that do not correspond to standard firmware components

Detection Strategies

Inspect HTTP request bodies to the switch management interface for characters such as ;, |, &, $(, and backticks within credential fields
Baseline the normal set of administrative source IP addresses and alert on management logins from unexpected origins
Correlate administrative authentication events with subsequent configuration changes on the switch to identify abuse of legitimate credentials

Monitoring Recommendations

Forward VigorSwitch syslog, authentication, and configuration change events to a centralized logging platform
Monitor management VLANs for unexpected egress traffic patterns from switch IP addresses
Alert on repeated failed administrative login attempts, which may precede credential-based exploitation of this vulnerability

How to Mitigate CVE-2026-71929

Immediate Actions Required

Apply the firmware updates listed in the DrayTek Security Advisory to all affected VigorSwitch models
Rotate all administrative credentials on affected devices, especially where credentials may have been reused or exposed
Restrict access to the web management interface to a dedicated management network or jump host
Audit switch configurations and account lists for unauthorized changes made prior to patching

Patch Information

DrayTek has published firmware updates addressing CVE-2026-71929 in the August 2026 VigorSwitch security advisory. Administrators should consult the vendor advisory for the specific fixed firmware version corresponding to each affected model and validate the upgrade in a maintenance window. Independent technical analysis is available from VulnCheck.

Workarounds

Disable remote access to the web management interface and require console or out-of-band access for administrative tasks until patches are applied
Enforce firewall access control lists that permit management connections only from trusted administrator workstations
Require multi-factor authentication and unique per-device credentials for switch administrators to reduce the value of stolen credentials

bash

# Example ACL restricting VigorSwitch web management to a management subnet
# Replace 10.10.0.0/24 with your dedicated management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80  -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP