Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

DrayTek VigorSwitch allows remote code execution before login

CVE-2026-71921 · published 10 days ago
Summary

Several DrayTek VigorSwitch network switches let an attacker send specially crafted data to the setget.cgi page, even before any user logs in. This can let the attacker run any command on the device with full administrative rights, potentially taking over the switch. Apply the vendor’s security update or block access to the setget.cgi page from untrusted networks as soon as possible.

What to do
  • Update draytek corporation vigorswitch g2540xs to version 3.9.10 or later.
  • Update draytek corporation vigorswitch p2540xs to version 3.9.10 or later.
  • Update draytek corporation vigorswitch fx2120 to version 3.9.10 or later.
  • Update draytek corporation vigorswitch g2282x to version 2.10.6 or later.
  • Update draytek corporation vigorswitch p2282x to version 2.10.6 or later.
  • Update draytek corporation vigorswitch q2300x to version 2.10.7 or later.
  • Update draytek corporation vigorswitch pq2300xb to version 2.10.7 or later.
  • Update draytek corporation vigorswitch g2542x to version 3.10.6 or later.
  • Update draytek corporation vigorswitch p2542x to version 3.10.6 or later.
  • Update draytek corporation vigorswitch p2542xh to version 3.10.6 or later.
  • Update draytek corporation vigorswitch px2060 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g1280 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p1280 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p1281x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g1282 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p1282 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g2121 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p2121 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch pq2121x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch q2121x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g2280x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p2280x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch q2200x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch pq2200xb to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g2100 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p2100 to version 2.9.10 or later.
  • Update draytek corporation vigorswitch g2540x to version 2.9.10 or later.
  • Update draytek corporation vigorswitch p2540x to version 2.9.10 or later.
Affected software
VendorProductAffected versions
draytek corporation vigorswitch g2540xs < 3.9.10
draytek corporation vigorswitch p2540xs < 3.9.10
draytek corporation vigorswitch fx2120 < 3.9.10
draytek corporation vigorswitch g2282x < 2.10.6
draytek corporation vigorswitch p2282x < 2.10.6
draytek corporation vigorswitch q2300x < 2.10.7
draytek corporation vigorswitch pq2300xb < 2.10.7
draytek corporation vigorswitch g2542x < 3.10.6
draytek corporation vigorswitch p2542x < 3.10.6
draytek corporation vigorswitch p2542xh < 3.10.6
draytek corporation vigorswitch px2060 < 2.9.10
draytek corporation vigorswitch g1280 < 2.9.10
draytek corporation vigorswitch p1280 < 2.9.10
draytek corporation vigorswitch p1281x < 2.9.10
draytek corporation vigorswitch g1282 < 2.9.10
draytek corporation vigorswitch p1282 < 2.9.10
draytek corporation vigorswitch g2121 < 2.9.10
draytek corporation vigorswitch p2121 < 2.9.10
draytek corporation vigorswitch pq2121x < 2.9.10
draytek corporation vigorswitch q2121x < 2.9.10
draytek corporation vigorswitch g2280x < 2.9.10
draytek corporation vigorswitch p2280x < 2.9.10
draytek corporation vigorswitch q2200x < 2.9.10
draytek corporation vigorswitch pq2200xb < 2.9.10
draytek corporation vigorswitch g2100 < 2.9.10
draytek corporation vigorswitch p2100 < 2.9.10
draytek corporation vigorswitch g2540x < 2.9.10
draytek corporation vigorswitch p2540x < 2.9.10
Original advisory text
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field...
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS 3%
Type
CWE-78OS Command Injection
Timeline
Published24 Aug 2026
Updated2 Sep 2026
First seen24 Aug 2026
Sources
CVE-2026-71921 · NVD
CVE-2026-71921 · MITRE
Monitor software like this
Free during beta