Skip to content
OpenAdvisories
High · 7.2 CVE-2026-71925 EUVD-2026-64984GHSA-f6x9-q3vc-f2xw

DrayTek VigorSwitch Multiple Models OS Command Injection via getDetail

Published Aug 24, 2026 · Updated Aug 24, 2026 · Assigned by VulnCheck

Vendor: DrayTek Product: VigorSwitch FX2120 Product: VigorSwitch G1280 Product: VigorSwitch G1282 Product: VigorSwitch G2100 Product: VigorSwitch G2121 Product: VigorSwitch G2280x Product: VigorSwitch G2282x Product: VigorSwitch G2540x Product: VigorSwitch G2540xs Product: VigorSwitch G2542x Product: VigorSwitch P1280 Product: VigorSwitch P1281x Product: VigorSwitch P1282 Product: VigorSwitch P2100 Product: VigorSwitch P2121 Product: VigorSwitch P2280x Product: VigorSwitch P2282x Product: VigorSwitch P2540x Product: VigorSwitch P2540xs Product: VigorSwitch P2542x Product: VigorSwitch P2542xh Product: VigorSwitch PQ2121x Product: VigorSwitch PQ2200xb Product: VigorSwitch PQ2300xb Product: VigorSwitch PX2060 Product: VigorSwitch Q2121x Product: VigorSwitch Q2200x Product: VigorSwitch Q2300x Category: Network devices

Description

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Affected products

VendorProductAffectedFixed
DrayTek VigorSwitch G2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch P2540xs < 3.9.10 3.9.10
DrayTek VigorSwitch FX2120 < 3.9.10 3.9.10
DrayTek VigorSwitch G2282x < 2.10.6 2.10.6
DrayTek VigorSwitch P2282x < 2.10.6 2.10.6
DrayTek VigorSwitch Q2300x < 2.10.7 2.10.7
DrayTek VigorSwitch PQ2300xb < 2.10.7 2.10.7
DrayTek VigorSwitch G2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542x < 3.10.6 3.10.6
DrayTek VigorSwitch P2542xh < 3.10.6 3.10.6
DrayTek VigorSwitch PX2060 < 2.9.10 2.9.10
DrayTek VigorSwitch G1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1280 < 2.9.10 2.9.10
DrayTek VigorSwitch P1281x < 2.9.10 2.9.10
DrayTek VigorSwitch G1282 < 2.9.10 2.9.10
DrayTek VigorSwitch P1282 < 2.9.10 2.9.10
DrayTek VigorSwitch G2121 < 2.9.10 2.9.10
DrayTek VigorSwitch P2121 < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2121x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2121x < 2.9.10 2.9.10
DrayTek VigorSwitch G2280x < 2.9.10 2.9.10
DrayTek VigorSwitch P2280x < 2.9.10 2.9.10
DrayTek VigorSwitch Q2200x < 2.9.10 2.9.10
DrayTek VigorSwitch PQ2200xb < 2.9.10 2.9.10
DrayTek VigorSwitch G2100 < 2.9.10 2.9.10
DrayTek VigorSwitch P2100 < 2.9.10 2.9.10
DrayTek VigorSwitch G2540x < 2.9.10 2.9.10
DrayTek VigorSwitch P2540x < 2.9.10 2.9.10

Advisories 2

References