CVE-2026-71930 is a high severity (CVSS 7.2) OS command injection in the setTime function of many DrayTek VigorSwitch models. An attacker with administrator credentials for the web interface can run commands as root. Install the fixed firmware for your model, listed below.
What's affected
Many DrayTek VigorSwitch models. VulnCheck lists, among others, G2540xs, P2540xs and FX2120 before 3.9.10, G2282x and P2282x before 2.10.6, Q2300x and PQ2300xb before 2.10.7, G2542x, P2542x and P2542xh before 3.10.6, and a long list of models such as PX2060, G1280, G2100 and G2121 before 2.9.10. The DrayTek advisory page is the authority for the full list. The record itself lists no products.
The weakness is CWE-78. Insufficient filtering of the username and password fields before command execution lets crafted input run commands with root privileges. Exploitation requires valid administrative credentials for the web management interface.
Severity differs by source: the record scores 7.2 high, and VulnCheck lists 8.6 high with a CVSS 4.0 vector.
How to check if you're exposed
Open the switch's web interface and read the firmware version from the system information page. Match your model to the table above and compare versions.
Switches are easy to leave unpatched, because they carry traffic for everything else and are rarely touched. Build a list of every VigorSwitch with its model and firmware version, from your network inventory or by walking the management addresses you control.
Check management exposure. The web interface should be reachable only from a management VLAN, and never from the internet or user networks.
free in-browser dependency scan is for application dependencies, so use the device itself for firmware checks.
What to do now
- List every DrayTek VigorSwitch and its firmware version.
- Download the fixed firmware for your model from DrayTek and schedule a maintenance window.
- Install the update, and check the version after the reboot.
- Restrict the web management interface to a management VLAN.
- Change any default or shared administrator passwords.
Why it matters
CWE-78 on a network switch is serious because of where the device sits: it sees and forwards traffic for every connected host. Root on the switch means the attacker can observe or change traffic, and can pivot into any network the switch connects.
The flaw needs administrator credentials, which cuts the risk considerably. Even so, administrative interfaces on infrastructure devices are often reachable from wide internal networks, and credentials are often shared. Patching and isolating the management plane are the two controls that matter.
Quick check
Why do the record and VulnCheck differ in score?
The record uses CVSS 3.1 and scores 7.2. VulnCheck lists 8.6 with a CVSS 4.0 vector. Both mark it high and both depend on administrator credentials.
Sources
Last reviewed: 18 October 2026.
