DrayTek VigorSwitch CVE-2026-71926

Exploitation requires valid administrative credentials for the device's web management interface - the CVSS PR:H metric confirms this is a high-privilege prerequisite, not an unauthenticated path. The attack is delivered over the network (AV:N) to the HTTP/HTTPS management port, meaning the management interface must be reachable from the attacker's location. No special non-default configuration is required beyond the management interface being accessible and admin credentials being known. What limits exploitation: (1) admin credentials must be compromised or known in advance; (2) the management interface must be network-reachable from the attacker - organizations that isolate management interfaces to out-of-band VLANs substantially reduce exposure; (3) no user interaction is required once credentials are obtained, meaning exploitation is otherwise straightforward. There is no requirement for a specific firmware version to be running based on available CPE data.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6, reflecting network reachability and full system-level impact, tempered significantly by the PR:H requirement - valid administrative credentials are a hard prerequisite. This substantially reduces opportunistic exploitation risk compared to unauthenticated vulnerabilities: an attacker must first compromise or possess admin-level access to the device's web interface before this vulnerability is relevant. There is no CISA KEV listing and no EPSS score was provided in the source data, so exploitation probability cannot be quantified numerically. No public proof-of-concept code has been identified. The realistic threat model centers on attackers who have already obtained admin credentials through phishing, credential stuffing, or lateral movement - at that point this vulnerability provides a reliable path to root-level device control. The wide model range (28+ SKUs) means that organizations running heterogeneous DrayTek switching infrastructure face a broad remediation scope. The absence of a scope change (SC:N/SI:N/SA:N) bounds the impact to the switch device itself rather than downstream network segments, but a compromised managed switch is still a high-value position for traffic interception or network reconfiguration.

An attacker who has obtained valid administrative credentials - through phishing, password reuse, or prior network compromise - authenticates to the VigorSwitch web management interface over the network. They submit a crafted configuration request to the setDevice function with a payload embedded in the username, password, or location field (e.g., a shell metacharacter sequence such as a semicolon or backtick followed by an arbitrary command). The device's backend processes this unsanitized input, executing the injected command as root, giving the attacker full control of the switch's operating system.