EXPOSURES › CVE-2026-71921

▸ RECOMMENDED ACTION  Critical severity — schedule patching of the affected products.

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.