CVE-2026-71915 in VigorSwitch G2540xs
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The DrayTek VigorSwitch series of network devices contains a critical security flaw within its embedded web management interface, specifically affecting the jsonstatus function. This vulnerability stems from an improper neutralization of special elements used in operating system commands, commonly categorized under CWE-78 as Improper Neutralization of Special Elements used in an OS Command or command injection. The root cause lies in the application's failure to adequately sanitize user-supplied input fields before passing them to underlying shell interpreters for execution. Specifically, the parameters named usescript, usefile, and option are processed without sufficient validation or escaping mechanisms. When these inputs contain maliciously crafted payloads containing special characters such as semicolons, pipes, or backticks, they allow an attacker to break out of the intended command context and inject arbitrary operating system commands into the execution stream.
From a technical perspective, this flaw represents a classic server-side code injection vulnerability where user input is directly concatenated with shell commands without proper boundary checks. The jsonstatus function appears to be designed for retrieving status information via JSON responses but inadvertently exposes an interface that accepts script or file parameters which are then executed by the system's command interpreter. Because these switches typically run embedded Linux-based firmware, and web management interfaces often operate with elevated privileges to perform administrative tasks, successful exploitation results in arbitrary code execution at the root level. This means there is no privilege escalation required beyond obtaining access to the interface; once inside, the attacker gains full control over the underlying operating system of the network switch.
The operational impact of this vulnerability is severe due to its potential for remote exploitation by authenticated users. While the requirement for valid administrative credentials limits the attack surface compared to unauthenticated exploits, it does not eliminate the risk entirely. Threat actors often target organizations with weak password policies, default credentials that have not been changed post-installation, or compromised admin accounts through phishing or other credential theft techniques. Once exploited, an attacker can execute any command available on the device's shell environment. This includes reading sensitive configuration files containing network topology details and security keys, modifying system settings to create persistent backdoors, pivoting into internal networks by using the switch as a foothold for lateral movement, or disrupting network availability by crashing services or altering routing tables. The ability to execute commands with root privileges effectively compromises the integrity, confidentiality, and availability of the entire segment connected through that device.
In terms of threat modeling and industry standards, this vulnerability aligns closely with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving shell access such as sh or bash on Unix-like systems. It also relates to T1190 Exploit Public-Facing Application if the administrative interface is exposed to untrusted networks without proper segmentation or multi-factor authentication. The lack of input validation in critical functions like jsonstatus highlights a deficiency in secure coding practices, falling under CWE-20 Improper Input Validation and potentially CWE-746 Improper Privilege Management if the function does not strictly enforce least privilege principles during execution.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The primary defense is to apply vendor-provided firmware updates that patch this specific command injection flaw in the jsonstatus function as soon as they become available from DrayTek. Until patches are applied, administrators should restrict access to the web management interface by placing it behind a firewall or VPN, ensuring it is not directly accessible from untrusted networks like the internet. Implementing strict network segmentation can limit lateral movement if an attacker does gain initial access. Additionally, enforcing strong, complex passwords for administrative accounts and enabling multi-factor authentication where supported significantly reduces the likelihood of credential compromise that precedes exploitation. Regular audits of device configurations to ensure unnecessary services are disabled and default credentials have been changed are also essential components of a robust security posture against such vulnerabilities.