CVE-2026-71916

Name of the Vulnerable Software and Affected Versions DrayTek VigorSwitch (affected versions not specified)

Description A command injection issue exists in the commandTable() function. The flaw stems from incomplete filtering of dangerous characters, including backticks, newline characters, and single quotes, within the parameter field. A remote attacker with valid administrative credentials for the web management interface can provide crafted input to execute arbitrary commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.