DrayTek VigorSwitch CVE-2026-71918

Exploitation requires possession of valid administrative credentials for the DrayTek VigorSwitch web management interface, confirmed by CVSS PR:H. The attacker must have network-layer connectivity to the management interface - typically TCP port 443 or 80 depending on configuration. The vulnerable webBackupAction function is reachable via the standard web management portal; no non-default feature enablement beyond default web management access is described as required. Limiting factors: (1) administrative credential possession is mandatory - CVSS PR:H explicitly excludes unauthenticated exploitation; (2) network access to the management interface is required, which is typically restricted to management VLANs in well-segmented environments; (3) exploitation is specific to unpatched firmware versions across the affected model list. The administrative credential requirement substantially limits opportunistic internet-scale exploitation but does not mitigate insider threats, credential compromise scenarios, or environments where management interfaces are accessible from general user network segments.

The CVSS 4.0 score of 8.6 accurately reflects the high C/I/A impact of root-level command execution on a managed network switch, which sits at a position of significant trust within enterprise and SMB topologies. The PR:H requirement (administrative credentials) is the principal constraint against mass exploitation and meaningfully separates this from critical unauthenticated network vulnerabilities. However, managed switch admin portals are frequently accessible from internal networks without strict access segmentation, and credential reuse, phishing of administrators, or insider threats represent realistic pre-exploitation paths. No KEV listing is present and no EPSS score was provided, which limits automated threat-signal prioritization; active exploitation is unconfirmed. The breadth of affected models - 28 or more VigorSwitch SKUs spanning the entire product line - amplifies aggregate organizational risk: any environment running multiple DrayTek switches faces compounded exposure, and a single compromised admin credential could affect every unpatched device on the management network. The absence of CVSS scope change metrics (SC:N/SI:N/SA:N) reflects single-device impact per the scoring framework, but lateral movement and pivot opportunities through a compromised network switch are operationally significant factors not captured in the base score.

An attacker who has acquired valid administrative credentials for a DrayTek VigorSwitch web management interface - through phishing, credential reuse from a previously compromised device, or internal network access - sends a crafted HTTP request to the webBackupAction endpoint with OS command payloads embedded in parameters such as option or valueN. The switch's web backend passes these unsanitized values directly to a shell command, executing the injected payload as root and granting the attacker full control of the device OS. No public exploit code has been identified at time of analysis, but the attack technique is consistent with well-documented OS command injection patterns and requires low technical sophistication once credentials are in hand.