External risk intelligence

DrayTek VigorSwitch Pre-Authentication Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71921

The vulnerability resides in a network-accessible web management interface of a network infrastructure device. While these management interfaces are often intended for internal administration, they are commonly exposed to the internet or reachable across network segments in many real-world deployments, and the interface is accessible without authentication.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical command injection vulnerability has been identified in multiple DrayTek VigorSwitch models, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges through the setget.cgi interface. The core issue stems from insufficient input filtering, which attackers can exploit by sending specially crafted data. This presents a significant risk to the integrity and control of affected network devices.

Attackers can run any command on vulnerable devices.
This impacts core network infrastructure and potential pivots.
Confirm exposure; address if present on your network.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted input to the `setget.cgi` interface on vulnerable DrayTek VigorSwitch devices. Because this interface is pre-authentication and lacks sufficient input filtering, the attacker can inject commands that are then executed with root privileges on the device. This could allow the attacker to take complete control of the affected switch.

No authentication required.
Triggered via crafted input to `setget.cgi`.
Enables arbitrary command execution as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary commands with root privileges on affected network devices when the `setget.cgi` interface is accessible.

System commands could be executed.
Via crafted input to `setget.cgi`.
Compromise of device functionality.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for network infrastructure and device management should prioritize this vulnerability. The first practical step is to identify all DrayTek VigorSwitch models deployed within your environment, determine their internet or cross-segment reachability, confirm their business criticality, and then assign ownership for remediation planning based on risk.

Network and security teams should own the issue.
Verify internet or cross-segment exposure first.
Plan remediation based on criticality and exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is a DrayTek VigorSwitch?

DrayTek VigorSwitch products are managed network switches designed to connect devices within a local network, such as computers, printers, and cameras. They serve as foundational infrastructure, directing data traffic to ensure reliable connectivity. Because they act as a central hub for communications, these devices are typically managed through an integrated web interface that allows administrators to configure network settings, monitor performance, and manage security policies remotely.

How does CVE-2026-71921 trigger a security failure?

This vulnerability is an instance of CWE-78, or OS Command Injection. It occurs because the device's setget.cgi interface fails to properly clean or filter input sent to the 'pass' field. Instead of treating that data as simple text, the system mistakenly processes it as a set of instructions. This allows an unauthorized user to inject their own system commands, which the switch then executes at the highest permission level, giving the attacker total control over the hardware.

Do I need to be logged in to trigger this command injection?

No, authentication is not required to trigger this vulnerability. The flaw exists in a pre-authentication interface, meaning an attacker does not need a valid username or password to interact with it. However, the attack only succeeds if the attacker can send crafted network packets directly to the setget.cgi interface. If the interface is not reachable over the network—for example, if it is blocked by a firewall—the attacker cannot reach the vulnerable code.

Why should I care about this DrayTek vulnerability?

You should care because Halo Surface Signal identifies this as a high-risk issue for internet-facing infrastructure. Because the vulnerability resides in a network-accessible web interface that requires no authentication, it can often be reached directly from the internet. If your switch is exposed in this way, an attacker can gain command execution from anywhere, potentially using the device as a foothold to access or pivot to other systems inside your network.

How do I respond if I use affected DrayTek switches?

The immediate priority is to locate all VigorSwitch units in your environment and assess their connectivity. Check whether the management interface is exposed to the internet or reachable across internal network segments. Once you have identified which devices are reachable, prioritize them for remediation. Coordinate with your network administration team to confirm the device count and ensure that access controls are tightened while you plan for the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.