DrayTek VigorSwitch CVE-2026-71923

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - the CVSS 4.0 PR:H metric explicitly confirms a high-privilege authentication prerequisite. The attacker must reach the device's web management interface over the network (AV:N); no special non-default configuration beyond an active admin account is required, as this is the standard operational state of any deployed VigorSwitch. Key limiting factors: (1) administrative credential possession is mandatory - without credentials the auth_set function cannot be reached in an exploitable way; (2) network reachability of the management interface is required - devices where management access is restricted to a dedicated management VLAN, out-of-band network, or trusted IP allowlist are substantially harder to exploit remotely; (3) the full-impact outcome (VC:H/VI:H/VA:H) is scoped to the switch OS, not downstream network infrastructure. The primary risk amplifiers are default credential use, shared passwords across devices, and Internet-exposed management interfaces.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H scores 8.6, reflecting a network-exploitable, low-complexity injection with full confidentiality, integrity, and availability impact on the vulnerable device. The PR:H requirement is the pivotal limiting factor: exploitation is gated on possession of valid administrative credentials, meaning this is not a remotely exploitable-by-default vulnerability and is not suitable for mass automated attack without a prior credential compromise step. No EPSS data was provided in the input, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA's KEV catalog and no public exploit code has been identified, further supporting a lower immediate exploitation urgency compared to unauthenticated network flaws at similar CVSS scores. Real-world risk is highest for organizations that expose VigorSwitch management interfaces to untrusted networks, use default or weak credentials, or share administrative passwords across devices - in those scenarios root command execution becomes readily achievable post-credential-acquisition. Scope is contained to the switch (SC:N/SI:N/SA:N), limiting lateral movement potential unless the switch's network position enables traffic interception or pivot.

An attacker who has acquired valid administrative credentials for a DrayTek VigorSwitch device - through credential reuse from a prior breach, phishing of network administrators, or exploitation of default passwords - authenticates to the web management interface and submits a crafted login request where the username or password field contains shell metacharacters followed by arbitrary OS commands. The auth_set function processes this input without sanitization and passes it to the underlying OS, executing the injected commands with root privileges on the switch. No public proof-of-concept code has been identified at time of analysis.