CVE-2026-71926

Multiple DrayTek VigorSwitch models are affected by a command injection vulnerability in the setDevice function. The root cause is insufficient sanitization of the username, password, and location fields before command execution, allowing a remote attacker to run arbitrary commands with root priv...

EUVD-2026-64985

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted...