DrayTek VigorSwitch CVE-2026-71924

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - this prerequisite is explicitly stated in the CVE description and confirmed by the CVSS 4.0 PR:H metric. The attacker must be able to reach the web management interface over the network (AV:N), which DrayTek typically hosts on a dedicated management port or VLAN; organizations that expose this interface to untrusted or Internet-facing segments face materially higher risk. The injection occurs in the username and password fields processed by the getVid function, so the web management service must be active - a condition that applies to all managed switch deployments using the web UI. No non-default feature enablement or special configuration mode is cited as a prerequisite. The primary limiting factors are the administrative credential requirement (PR:H) and the assumption that management interfaces are network-segregated; environments where either condition does not hold - default credentials unchanged, or management accessible from untrusted networks - should treat exploitation as significantly more feasible than the raw CVSS vector implies.

The CVSS 4.0 score of 8.6 is principally driven by the full-impact triad (VC:H/VI:H/VA:H) and network attack vector, but the PR:H metric is the decisive mitigating signal - exploitation is gated on possession of valid administrative credentials for the web management interface, sharply narrowing the realistic attacker class. EPSS data was not included in the available intelligence feed, leaving statistical exploitation probability unquantified; this gap should be monitored as the advisory matures. Neither a CISA KEV listing nor confirmed public exploit code has been identified at time of analysis, which further reduces immediate mass-exploitation risk relative to the raw score. The practical threat profile centers on insiders, credential-reuse scenarios, and attackers who have completed a prior initial-access step to harvest admin credentials. The wide model footprint - 28+ distinct VigorSwitch SKUs per vendor tags - amplifies aggregate organizational exposure, particularly in SMB and campus environments where DrayTek switching is common and where management interfaces may not be isolated to dedicated management VLANs. Organizations with Internet-exposed management interfaces face substantially elevated risk regardless of the PR:H gate, as credential stuffing or default-credential attacks could lower the effective barrier to exploitation.

An attacker who has obtained valid administrative credentials for a DrayTek VigorSwitch - whether through credential stuffing against a management interface exposed to the Internet, internal credential theft, or reuse of unchanged default passwords - authenticates to the web management interface and submits a crafted username or password value containing OS command injection payloads to the getVid function. The insufficient input filtering passes the malicious value directly into a system command call, resulting in arbitrary command execution with root privileges on the switch operating system. No public exploit code has been identified at time of analysis, but the attack surface is low-complexity for any actor already holding admin credentials.