DrayTek VigorSwitch CVE-2026-71919

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - confirmed by both the CVE description and the CVSS 4.0 vector's PR:H metric. The attack is delivered over the network (AV:N) to the device's HTTP/HTTPS management interface. No additional non-default configuration is required beyond the attacker possessing admin-level credentials. Limiting factors include: (1) the attacker must first authenticate as an administrator, ruling out unauthenticated exploitation; (2) the management interface must be network-reachable from the attacker's position; (3) exploitation is bounded to the switch itself (no confirmed lateral scope change). Organizations that restrict management interface exposure to dedicated management VLANs and enforce strong, unique admin credentials substantially reduce the realistic attack surface despite the AV:N vector.

The CVSS 4.0 score of 8.6 reflects high network-reachable impact (VC:H/VI:H/VA:H) tempered by the PR:H requirement, meaning an attacker must already hold valid administrative credentials before exploitation is possible. AC:L and AT:N indicate no special attack complexity or prerequisites beyond authentication, and UI:N confirms no victim interaction is needed once authenticated. The absence of a scope change (SC:N/SI:N/SA:N) bounds the blast radius to the vulnerable device itself. No EPSS data was provided, and no CISA KEV listing exists, so widespread opportunistic exploitation has not been confirmed. Real-world risk is meaningfully lower than the score alone implies: an adversary must first compromise or possess admin credentials, which typically requires a prior breach, phishing of an administrator, credential stuffing, or reuse of default credentials. However, should admin credentials be obtained, the path to root-level arbitrary command execution is straightforward and unauthenticated lateral movement to the switch's managed network segments becomes possible. Post-exploitation impact on network infrastructure is severe.

An attacker who has obtained valid administrative credentials - via credential stuffing, phishing, or reuse of default passwords - logs into the VigorSwitch web management interface and submits a crafted HTTP request to the sysreboot endpoint with OS command metacharacters embedded in the config or valueN parameters. The unsanitized input is passed directly to a shell interpreter, executing arbitrary commands as root on the switch's operating system. No public exploit code has been identified at time of analysis, but the vulnerability class and affected code path are straightforward to exploit for anyone with working administrative access.