DrayTek VigorSwitch CVE-2026-71925

Exploitation requires valid administrative credentials for the device's web management interface, confirmed by PR:H in the CVSS 4.0 vector. The management interface must be network-accessible from the attacker's position (AV:N). The specific vulnerable code path is the getDetail function's handling of the username and password input fields - meaning the attacker must be able to interact with the authentication or post-authentication management flow to inject commands. No user interaction beyond the attacker's own session is required (UI:N). Exploitation is bounded by three concrete prerequisites: (1) possession of valid admin-level credentials, (2) network reachability to the web management interface, and (3) a vulnerable firmware version running on one of the affected models. Devices whose management interface is isolated to a dedicated management VLAN or blocked at perimeter have materially reduced exposure despite the network attack vector.

The CVSS 4.0 score of 8.6 is materially constrained by PR:H, meaning an attacker must first possess valid administrative credentials before exploitation is possible. The network attack vector (AV:N) and low attack complexity (AC:L, AT:N) indicate that once credentials are in hand, exploitation is straightforward and remotely executable without interaction. The full C:H/I:H/A:H impact on the vulnerable system reflects root-level command execution, which is severe - but restricted to actors who already control an admin account. No CISA KEV listing is present in the provided data, and no public exploit or POC has been identified, which tempers urgency relative to the raw score. EPSS data was not provided. Real-world risk is highest for organizations that expose VigorSwitch management interfaces to untrusted networks or that practice credential reuse across devices, and lower for environments where management plane access is strictly firewalled. The absence of a scope change (SC:N/SI:N/SA:N) bounds blast radius to the compromised switch itself, though switch-level compromise carries significant network-interception and pivoting potential.

An attacker who has obtained valid VigorSwitch administrative credentials - through phishing, credential stuffing, insider access, or reuse of credentials stolen from another system - authenticates to the web management interface and submits a crafted request to the getDetail function with shell metacharacters embedded in the username or password fields. Because input sanitization is absent, the injected payload is interpreted by the underlying OS and executed as root, granting the attacker full control of the switch firmware, the ability to exfiltrate management-plane secrets, or the ability to intercept or manipulate network traffic traversing the device.