OS Command Injection in DrayTek Corp. products - CVE-2026-71930

Vulnerability identifier: #VU151544

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-71930

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the setTime function. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

VigorSwitch P2540x
VigorSwitch G2540x
VigorSwitch G1280
VigorSwitch P1280
VigorSwitch G1282
VigorSwitch P2100
VigorSwitch G2100
VigorSwitch PQ2200xb
VigorSwitch Q2200x
VigorSwitch P2280x
VigorSwitch G2280x
VigorSwitch Q2121x
VigorSwitch PQ2121x
VigorSwitch P2121
VigorSwitch G2121
VigorSwitch P1282
VigorSwitch P1281x
VigorSwitch PX2060
VigorSwitch PQ2300xb
VigorSwitch Q2300x
VigorSwitch P2282x
VigorSwitch G2282x
VigorSwitch G2540xs
VigorSwitch EX2120
VigorSwitch P2540xs
VigorSwitch P2542xh
VigorSwitch P2542x
VigorSwitch G2542x

Install updates from vendor's website.

VigorSwitch P2540x - update to 2.9.10
VigorSwitch G2540x - update to 2.9.10
VigorSwitch G1280 - update to 2.9.10
VigorSwitch P1280 - update to 2.9.10
VigorSwitch G1282 - update to 2.9.12
VigorSwitch P2100 - update to 2.9.12
VigorSwitch G2100 - update to 2.9.12
VigorSwitch PQ2200xb - update to 2.9.12
VigorSwitch Q2200x - update to 2.9.12
VigorSwitch P2280x - update to 2.9.12
VigorSwitch G2280x - update to 2.9.12
VigorSwitch Q2121x - update to 2.9.12
VigorSwitch PQ2121x - update to 2.9.12
VigorSwitch P2121 - update to 2.9.12
VigorSwitch G2121 - update to 2.9.12
VigorSwitch P1282 - update to 2.9.12
VigorSwitch P1281x - update to 2.9.12
VigorSwitch PX2060 - update to 2.9.12
VigorSwitch PQ2300xb - update to 2.10.9
VigorSwitch Q2300x - update to 2.10.9
VigorSwitch P2282x - update to 2.10.9
VigorSwitch G2282x - update to 2.10.9
VigorSwitch G2540xs - update to 3.9.12
VigorSwitch EX2120 - update to 3.9.12
VigorSwitch P2540xs - update to 3.9.12
VigorSwitch P2542xh - update to 3.10.9
VigorSwitch P2542x - update to 3.10.9
VigorSwitch G2542x - update to 3.10.9

• https://www.draytek.com/about/security-advisory/security-update-for-vigorswitch-series-september-2026

• Multiple vulnerabilities in DrayTek VigorSwitch Series