DrayTek VigorSwitch CVE-2026-71928

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - the CVSS PR:H metric confirms this high-privilege prerequisite; unauthenticated exploitation is not possible. The attacker must have network-level reachability to the web management interface (typically HTTP/HTTPS, default port 80 or 443). The vulnerability is specifically triggered when crafted input is supplied in the username or password authentication fields processed by the fdftDevice function. Exploitation is constrained by: the hard requirement for administrative credentials (PR:H), network accessibility to the management interface, and the specific affected VigorSwitch models and firmware versions. Devices where the web management interface is isolated behind a management VLAN with strict ACLs, using strong non-default credentials, face substantially reduced practical risk despite the network attack vector.

The CVSS 4.0 base score of 8.6 reflects full impact across confidentiality, integrity, and availability, but this must be read alongside the PR:H prerequisite - valid administrative credentials are required, which significantly narrows the realistic attack surface compared to unauthenticated network vulnerabilities. No EPSS score was provided in the available intelligence, so exploitation probability cannot be precisely quantified. The vulnerability is not listed in CISA KEV, and no public exploit code has been identified, placing exploitation status as unconfirmed at time of analysis. Real-world risk is highest in environments where management interfaces are internet-exposed, default or weak credentials are in use, or where credential reuse from prior breaches is likely - even a small network operations team managing dozens of DrayTek switches faces material risk if credential hygiene is poor. The CVSS vector is internally consistent with the description: network-reachable, admin-authenticated, low-complexity post-auth exploit yielding root execution with no scope change to other systems.

An attacker who obtains valid DrayTek VigorSwitch administrative credentials - via credential stuffing against exposed management interfaces, phishing, or exploitation of default factory passwords - authenticates to the web management interface and submits a crafted payload containing shell metacharacters in the username or password field targeting the fdftDevice function. The unsanitized input is passed directly into an OS command execution routine, granting root-level code execution on the switch's embedded OS. From this position, the attacker can alter switch configurations, capture or redirect network traffic, install persistent backdoors in firmware, or use the switch as a pivot point into adjacent network segments.