DrayTek VigorSwitch CVE-2026-71920

The CVE description explicitly states that exploitation requires valid administrative credentials for the device's web management interface - this is the primary and decisive constraint. The attacker must reach the web management interface over the network (AV:N per CVSS 4.0). The triggering condition is a crafted HTTP request to the formlogout endpoint that omits or sends an empty Cookie header, which the handler processes without null-checking before string operations. What limits exploitation: admin-level authentication (PR:H) is mandatory and cannot be bypassed by this vulnerability alone - an attacker must separately acquire admin credentials before this flaw is reachable. Impact is bounded to availability of the web management service only; data-plane switch forwarding is not affected, and no confidentiality or integrity impact is possible per the CVSS metrics.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately characterizes the risk: the management interface is network-reachable without complexity, but the mandatory admin credential prerequisite (PR:H) sharply constrains the realistic attacker pool to those who have already achieved privileged access through a separate compromise path. Impact is limited exclusively to availability of the web management service - no confidentiality or integrity impact is possible per the CVSS metrics, and the switch data plane is unaffected. No EPSS score is available to quantify exploitation probability, and neither CISA KEV listing nor POC exploit code is referenced in the available data, reinforcing the assessment that this is not a widely exploited issue. The practical business risk is temporary management-plane outage - disruptive for network operations teams but recoverable - and secondary only to ensuring that admin credentials are not exposed. The 6.9 score is proportionate given the authentication barrier and DoS-only impact.

An attacker who has obtained valid administrative credentials - for example through credential reuse or phishing - authenticates to a vulnerable VigorSwitch web management interface and sends a crafted HTTP request to the formlogout endpoint with the Cookie header omitted or set to an empty value. The formlogout function dereferences a null pointer, crashing the web management service and rendering the switch unmanageable via the web UI until the service recovers or the device is rebooted. No public exploit code is referenced in the available data.