DrayTek VigorSwitch CVE-2026-71927

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - the CVSS 4.0 vector confirms PR:H, meaning high-privilege authenticated access is mandatory. The attacker must be able to reach the web management interface over the network (AV:N), which in properly segmented environments would typically be restricted to a management VLAN or internal network. No special non-default configuration is required beyond the management interface being enabled, which is the default operational mode for managed switches. Exploitation is limited by: (1) requirement for administrative credentials, which must be obtained through a prior compromise or weak/default credential scenario; (2) network reachability to the management interface, which should be restricted by policy. There is no user interaction requirement and no complexity barrier beyond possessing credentials.

The CVSS 4.0 score of 8.6 reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring high-privilege credentials (PR:H) with no user interaction, resulting in full confidentiality, integrity, and availability compromise of the vulnerable system. The PR:H requirement is the primary risk-limiting factor - exploitation is gated on possession of valid administrative credentials for the web management interface, substantially reducing the attack surface compared to unauthenticated variants. No EPSS data was provided, but given the credential prerequisite, opportunistic mass exploitation is unlikely; targeted attacks against organizations where credentials are known, weak, or reused from other breaches represent the realistic threat model. No CISA KEV listing has been identified, and no public POC has been noted, making this a medium-priority issue for most organizations unless the management interface is internet-exposed. SSVC-style assessment: exploitation status is unproven (no KEV/POC), automation is constrained by required authentication, and technical impact is total if credentials are obtained - suggesting a defer-to-patch posture for air-gapped or internally-managed deployments, and urgent remediation for any switches with internet-facing management interfaces.

An attacker who has obtained DrayTek VigorSwitch administrative credentials - through credential stuffing, phishing, or reuse from a previous breach - authenticates to the device's web management interface and submits a crafted username or password containing shell metacharacters (e.g., backticks or semicolons) to the rebDevice function endpoint. The unsanitized input is passed directly to an OS command, executing attacker-supplied code as root, granting full control over the switch firmware, configuration, and network traffic. No public POC has been identified, but the technique is well-understood for CWE-78 in embedded web interfaces.