DrayTek VigorSwitch CVE-2026-71916

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - this is explicitly stated in the description and confirmed by the CVSS 4.0 vector's PR:H metric. The commandTable function must be reachable, which is standard when the web management interface is accessible. Exploitation is therefore limited to actors who have already achieved administrative-level authentication, whether through legitimate access, credential theft, default credential exploitation, or brute force. The attack is network-reachable (AV:N) but does not work against unauthenticated sessions. There is no indication of non-default configuration required beyond having admin credentials. Limiting factors: admin credential possession is the key gate; environments enforcing multi-factor authentication on management interfaces, strong unique passwords, and network-level restrictions on management interface exposure significantly reduce realistic exploitation probability.

The CVSS 4.0 score of 8.6 is driven primarily by the high confidentiality, integrity, and availability impact metrics against the vulnerable system, but PR:H (high privileges required) is the most important constraint for realistic risk prioritization - an attacker must already hold valid administrative credentials before exploitation is possible. This materially narrows the attack surface compared to unauthenticated network-exposed vulnerabilities. No EPSS data was provided in the intelligence package, and this CVE does not appear in CISA KEV, meaning exploitation in the wild has not been confirmed. No public exploit code has been identified at time of analysis. The practical risk concentrates on environments where switch management interfaces are exposed to untrusted networks, where default or weak admin credentials are in use, or where admin credentials may have been compromised through phishing or credential reuse - even a mid-sized municipal IT team managing a mixed-vendor switch estate should treat this as urgent given the root-level command execution impact and the breadth of affected models. The absence of KEV listing should not produce complacency: network infrastructure compromise via authenticated-but-exploitable admin interfaces is a well-documented lateral movement pattern.

An attacker who has obtained valid administrative credentials - via credential reuse, phishing, brute force against an exposed management interface, or insider access - authenticates to the VigorSwitch web management interface and submits a crafted HTTP request to the commandTable endpoint with a parameter value containing a backtick-wrapped OS command or a newline-injected command sequence. The device processes the input through an insufficiently filtered shell execution path, causing the injected command to run as root, granting the attacker full control over the switch including traffic inspection, routing manipulation, or persistent backdoor installation. No public exploit code has been identified at time of analysis.