CVE-2026-71921 [CRITICAL] – Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnera

Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is caused by insufficient filtering of the pass field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges.