Is CVE-2026-71921 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-71921?

CVE-2026-71921 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-71921

Description

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.