EUVD-2026-64980
GHSA-c34j-h938-5r57
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach switch web management interface
-
DeliverySend crafted request to setget.cgi
-
ExploitInject shell metacharacters via 'pass' field
-
ExecutionCommand executes as root
-
ImpactFull device takeover and pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the switch's web management interface exposing setget.cgi; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is needed, so any affected VigorSwitch model whose management HTTP(S) service is reachable by the attacker is exploitable against default configurations. The primary limiting factor is network exposure of the management plane: switches administered only over an isolated management VLAN or with the web UI firewalled off are not remotely reachable, sharply reducing real-world exploitability. There is no platform/version prerequisite beyond running affected VigorSwitch firmware, and no evidence a specific feature must be enabled - the vulnerable setget.cgi endpoint is part of the standard management interface. |
| Impact | This is a genuine high-priority issue rather than an inflated CVSS score. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with full confidentiality, integrity and availability impact - consistent with the description of pre-auth command injection yielding root. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT on CISA KEV and no POC was referenced, so there is no public exploit identified at time of analysis; the risk is driven by ease of exploitation and root-level impact rather than confirmed active exploitation. Reporting by VulnCheck and a coordinated vendor advisory raise confidence in the finding's validity. The main caveat: network switches are frequently on management VLANs, so real-world exposure depends heavily on whether the management interface is internet- or broadly network-accessible. |
| Exploit ScenarioDerived | An attacker who can reach a VigorSwitch management interface (for example, an exposed or internet-facing admin port, or a foothold on the same management network) sends a single crafted HTTP request to setget.cgi with shell metacharacters embedded in the 'pass' field. Because the endpoint requires no authentication (PR:N) and complexity is low (AC:L), the injected command executes immediately as root, giving full device takeover. No POC was referenced, so this scenario is inferred from the CVSS vector and description rather than an observed public exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 24, 2026
Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it.
RemediationAI
Patch available per vendor advisory: DrayTek published a VigorSwitch series security advisory (August 2026) addressing this issue - apply the fixed firmware for your exact model as listed at https://www.draytek.com/about/security-advisory/multiple-vulnerabilities-in-vigorswitch-series-august-2026/ (exact fixed version not stated in the available data, so verify the per-model build on the vendor page before deploying). Until firmware can be updated, restrict reachability of the web management interface: place switch management on an isolated management VLAN, block access to setget.cgi and the HTTP/HTTPS admin service from untrusted networks and the internet via ACLs or upstream firewall rules, and limit management to a small set of trusted admin hosts. Note trade-offs: disabling or firewalling the web UI removes remote GUI administration and may break monitoring tools that poll the interface, so ensure CLI/out-of-band management remains available. Because exploitation is pre-authentication, changing admin credentials alone does not mitigate - network-level access restriction is the key compensating control until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 28 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
VigorSwitch devices expose a web-based management interface whose CGI backend (setget.cgi) handles configuration get/set operations. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): the 'pass' parameter is incorporated into an OS command invocation without adequate sanitization or filtering, so shell metacharacters injected into that field are interpreted by the underlying command shell. Because the CGI runs with root privileges on the embedded Linux firmware and the endpoint is reachable prior to authentication, injected commands execute as root. The affected CPEs are enumerated under vendor draytek_corporation across numerous vigorswitch_* models (e.g. cpe:2.3:a:draytek_corporation:vigorswitch_g2540xs, :p2282x, :q2300x, :g2542x, :p2542xh), indicating a shared codebase across the switch line.
Know when Vigorswitch G2540Xs gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Pre-auth (PR:N), network-reachable (AV:N), low-complexity (AC:L) command injection yielding root gives full C/I/A:H; scope unchanged as impact stays on the device OS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.
Executive ViewAI
DrayTek VigorSwitch managed switches contain a critical pre-authentication remote code execution vulnerability affecting multiple product lines (G/P/Q-series models including G2540Xs, P2282X, Q2300X, G2542X and approximately 30 additional variants). Unauthenticated attackers can execute arbitrary commands with root privileges on affected switches, and no vendor patch is currently available, creating unmitigated risk for organizations dependent on these devices for network operations.
Network segmentation restricting management access to trusted administrative subnets only; mandatory credential rotation and enforcement of strong access control lists on all management interfaces; network-based intrusion detection and continuous monitoring for anomalous commands targeting setget.cgi; disable remote management over untrusted networks; evaluate switch isolation or replacement if internal exposure cannot be eliminated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Vigorswitch G2540Xs
View allCommand injection in DrayTek VigorSwitch's setDevNet function allows authenticated remote attackers to execute arbitrary
Command injection in DrayTek VigorSwitch's setTime function enables authenticated administrators to execute arbitrary OS
Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS co
Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers hold
Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbit
Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to
Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute
Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator
Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arb
Command injection in DrayTek VigorSwitch's tftp_upgrade function enables authenticated remote administrators to execute
Command injection via the commandTable function affects 28 DrayTek VigorSwitch managed switch models across multiple fir
Command injection in DrayTek VigorSwitch firmware's fdftDevice function allows an authenticated remote administrator to
Exploit-DB