40
CVEs
2
Critical
36
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
1.9%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
36
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Vigorswitch Px2060
29
Vigorswitch P2542Xh
29
Vigorswitch G2121
29
Vigorswitch P2121
29
Vigorswitch P2542X
29
Vigorswitch G1280
29
Vigorswitch P1280
29
Vigorswitch G2540X
29
Vigorswitch G1282
29
Vigorswitch G2282X
29
Vigorswitch P2540Xs
29
Vigorswitch G2100
29
Vigorswitch P2282X
29
Vigorswitch P2100
29
Vigorswitch P1281X
29
Vigorswitch Pq2200Xb
29
Vigorswitch P1282
29
Vigorswitch P2540X
29
Vigorswitch Q2200X
29
Vigorswitch Q2300X
29
Vigorswitch G2542X
29
Vigorswitch Q2121X
29
Vigorswitch Fx2120
29
Vigorswitch Pq2300Xb
29
Vigorswitch G2540Xs
29
Vigorswitch G2280X
29
Vigorswitch Pq2121X
29
Vigorswitch P2280X
29
Vigorap 1060C
11
Vigorap 912C
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-71921 | Pre-authentication OS command injection in DrayTek VigorSwitch managed switches lets a remote, unauthenticated attacker run arbitrary commands as root by supplying crafted input to the setget.cgi 'pass' field, which is passed to a shell without sufficient filtering. The flaw affects a broad range of VigorSwitch models (G/P/Q-series including G2540Xs, P2282X, Q2300X, G2542X and ~30 listed variants) and carries a CVSS 4.0 score of 9.3. No public exploit has been identified at time of analysis, but DrayTek has published a security advisory addressing it. | CRITICAL | 9.3 | 3.2% | 50 |
|
| CVE-2026-71914 | Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis. | CRITICAL | 9.3 | 3.1% | 50 |
|
| CVE-2026-71905 | Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via the ExportSettings function. Insufficient input sanitization of the backupkey, backuptype, and realtime parameters permits shell metacharacter injection before those values are passed to a system command. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates technical impact as total given root-level code execution on network infrastructure devices. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71906 | Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the root-level code execution outcome warrants prompt firmware upgrade wherever management interfaces are network-reachable. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71907 | Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute arbitrary OS commands with root privileges by submitting crafted input to the setcamset function via the web management interface. Six distinct VigorAP models are confirmed affected across multiple firmware branches, each with a separate patch target version released in August 2026. No public exploit identified at time of analysis, but the network-accessible attack vector and root-level impact make this a high priority for organizations with internet-exposed VigorAP management interfaces. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71908 | Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbitrary OS commands with root privileges across six VigorAP models. The vulnerability exists in the mesh_start_speed_test function, where unsanitized meshdevice_index and meshdevice_ip input is passed directly to shell command execution, yielding complete device compromise including full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected models; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71909 | Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authenticated remote attacker to execute arbitrary OS commands with root privileges by submitting crafted input to the InquierTime function's time field via the web management interface. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the time parameter is passed to a system shell without adequate filtering, enabling shell metacharacter injection. No public exploit identified at time of analysis; a vendor-released patch is available across all affected model lines. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71910 | Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands with root privileges. Six CPE-confirmed models across the VigorAP 903, 906, 912C, 918R, 960C, and 1060C series are affected in all firmware versions below their respective patch thresholds. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available and should be applied promptly given the root-level impact. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71915 | Command injection in DrayTek VigorSwitch's jsonstatus function allows authenticated remote administrators to execute arbitrary OS commands as root by submitting crafted values in the usescript, usefile, or option fields. At least 28 distinct VigorSwitch models across multiple firmware branches are confirmed affected per EUVD-2026-64974 and vendor advisory. Vendor-released patches are available; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71917 | Command injection in the DrayTek VigorSwitch series' pingtrace diagnostic function allows an authenticated administrator to execute arbitrary OS commands with root privileges by submitting a crafted host field value. Twenty-eight distinct VigorSwitch models across the G, P, Q, PQ, FX, and PX series are affected, with patched firmware releases varying by model family (2.9.10, 2.10.6, 2.10.7, and 3.10.6). No public exploit has been identified at time of analysis and CISA has not listed this in KEV; exploitation is constrained by the mandatory administrative credential requirement confirmed by the CVSS PR:H metric. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71918 | Command injection in the DrayTek VigorSwitch `webBackupAction` function allows authenticated remote attackers to execute arbitrary OS commands with root privileges across more than 25 managed switch models. Insufficient input sanitization of the `option`, `key`, `pw_encode`, `pathN`, and `valueN` parameters enables shell metacharacter injection, resulting in full device compromise. No public exploit has been identified at time of analysis; the administrative credential prerequisite is the primary barrier against opportunistic exploitation. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71919 | Command injection in multiple DrayTek VigorSwitch managed switch models allows an authenticated remote administrator to execute arbitrary OS commands with root privileges via the web management interface. The flaw resides in the sysreboot function, which fails to sanitize the config, act, pathN, and valueN parameters before passing them to OS command execution, per CWE-78. No public exploit or CISA KEV listing exists at time of analysis, but the VulnCheck and DrayTek advisories confirm the vulnerability across at least 28 VigorSwitch SKUs. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71924 | Command injection in DrayTek VigorSwitch's getVid function allows an authenticated remote administrator to execute arbitrary OS commands with root privileges by supplying crafted values in the username or password fields of the web management interface. At least 28 VigorSwitch models across the G, P, Q, PQ, and FX series are confirmed affected by the DrayTek August 2026 security advisory and VulnCheck reporting. No public exploit code has been identified at time of analysis, but the breadth of affected models and full root-level impact make this a patch-priority item for any organization operating DrayTek managed switching infrastructure. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71925 | Command injection in multiple DrayTek VigorSwitch models' getDetail function enables authenticated remote attackers holding valid administrative credentials to execute arbitrary OS commands with root privileges. The flaw (CWE-78) arises from the web management interface failing to sanitize username and password fields before incorporating them into system command execution. DrayTek published a security advisory in August 2026 covering a broad range of VigorSwitch models; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.6 | 3.1% | 46 |
|
| CVE-2026-71929 | Command injection in multiple DrayTek VigorSwitch models enables authenticated administrators to execute arbitrary OS commands with root privileges through the setDevProto function's unsanitized username and password fields. At least 10 CPE-confirmed models are affected, with vendor tags suggesting a broader footprint of approximately 28 VigorSwitch variants. No public exploit code or CISA KEV listing has been identified at time of analysis; however, DrayTek published a security advisory in August 2026 acknowledging the vulnerability and the authentication prerequisite of valid admin credentials is the primary constraint on real-world exploitation. | HIGH | 8.6 | 3.1% | 46 |
|