What’s Vulnerable › Vulnerabilities

CVE-2026-71921: DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-24 · updated 2026-10-13
• Weakness: CWE-78

Description

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.

Affected products

• DrayTek Corporation VigorSwitch FX2120: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch G2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch G2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch G2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P1280: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1281x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P1282: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2100: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2121: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2280x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2282x: before 2.10.6 — fixed in 2.10.6
• DrayTek Corporation VigorSwitch P2540x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch P2540xs: before 3.9.10 — fixed in 3.9.10
• DrayTek Corporation VigorSwitch P2542x: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch P2542xh: before 3.10.6 — fixed in 3.10.6
• DrayTek Corporation VigorSwitch PQ2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2200xb: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch PQ2300xb: before 2.10.7 — fixed in 2.10.7
• DrayTek Corporation VigorSwitch PX2060: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2121x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2200x: before 2.9.10 — fixed in 2.9.10
• DrayTek Corporation VigorSwitch Q2300x: before 2.10.7 — fixed in 2.10.7

How to fix

Upgrade to a fixed version: DrayTek Corporation VigorSwitch FX2120 3.9.10; DrayTek Corporation VigorSwitch G1280 2.9.10; DrayTek Corporation VigorSwitch G1282 2.9.10; DrayTek Corporation VigorSwitch G2100 2.9.10; DrayTek Corporation VigorSwitch G2121 2.9.10; DrayTek Corporation VigorSwitch G2280x 2.9.10; DrayTek Corporation VigorSwitch G2282x 2.10.6; DrayTek Corporation VigorSwitch G2540x 2.9.10; DrayTek Corporation VigorSwitch G2540xs 3.9.10; DrayTek Corporation VigorSwitch G2542x 3.10.6; DrayTek Corporation VigorSwitch P1280 2.9.10; DrayTek Corporation VigorSwitch P1281x 2.9.10. Check the vendor advisory for mitigations.

References

• https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
• https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-pre-authentication-os-command-injection-via-setget-cgi

Get alerted when CVE-2026-71921 or the next vulnerability affects your stack