A critical (CVSS 9.8) pre-authentication command injection flaw in the setget.cgi interface lets remote attackers execute arbitrary commands as root across a wide range of DrayTek VigorSwitch models.
What Is It
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The root cause is insufficient filtering of the pass field before it reaches command execution. A remote attacker can trigger the flaw with crafted input and execute arbitrary commands with root privileges.
NVD scores the issue 9.8 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges, and no user interaction required. The CVE was published 2026-08-24 and reported by VulnCheck.
Why It Matters
There is no authentication barrier in front of this bug. Anything that can reach the switch's web management interface can reach setget.cgi, and successful exploitation yields root-level command execution on network infrastructure; the layer that carries and segments traffic for everything behind it. The combination of pre-auth reachability, low attack complexity, and full confidentiality, integrity, and availability impact is the worst-case profile for an edge or internal management-plane device.
As of this writing, the CVE does not appear in the CISA Known Exploited Vulnerabilities catalog. That is not a statement that the flaw is unexploited; KEV listings lag discovery, and a pre-auth root RCE in widely deployed switching hardware is exactly the class of bug that attracts opportunistic scanning once details are public. Treat the absence of a KEV entry as an unknown, not as reassurance, and prioritize patching on the CVSS profile alone.
What's Vulnerable
DrayTek Corporation VigorSwitch devices, with fixed firmware differing by model family:
- Below 3.9.10: VigorSwitch G2540xs, P2540xs, FX2120
- Below 3.10.6: VigorSwitch G2542x, P2542x, P2542xh
- Below 2.10.7: VigorSwitch Q2300x, PQ2300xb
- Below 2.10.6: VigorSwitch G2282x, P2282x
- Below 2.9.10: VigorSwitch PX2060, G1280, P1280, P1281x, G1282, P1282, G2121, P2121, PQ2121x, Q2121x, G2280x, P2280x, Q2200x, PQ2200xb
DrayTek's advisory is the authoritative source for the complete affected-model and fixed-version matrix; verify any switch not named above against it directly rather than assuming it is unaffected.
Patch Status
DrayTek has published a security advisory covering multiple VigorSwitch vulnerabilities (August 2026) with fixed firmware versions per model. Remediation is to upgrade affected switches to at or above the fixed version listed for that model. Management interfaces should not be exposed to untrusted networks.
Sources
- DrayTek Security Advisory; Multiple Vulnerabilities in VigorSwitch Series (August 2026): https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/
- VulnCheck Advisory; DrayTek VigorSwitch Pre-Authentication OS Command Injection via setget.cgi: https://www.vulncheck.com/advisories/draytek-vigorswitch-multiple-models-pre-authentication-os-command-injection-via-setget-cgi
- NVD, CVE-2026-71921
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog