DrayTek VigorSwitch CVE-2026-71929

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - the CVSS 4.0 PR:H metric confirms high-privilege authentication is mandatory and is explicitly stated in the CVE description. The attacker must have network access to the web management interface (AV:N). The vulnerability is triggered specifically by submitting crafted input to the setDevProto function via the username or password fields - no special non-default device configuration is required beyond the management interface being reachable. The primary factor limiting exploitation is the admin credential requirement: an attacker without valid credentials cannot reach the vulnerable code path. Deployment postures most at risk are internet-exposed management interfaces combined with weak, default, or reused credentials. Environments where the management interface is restricted to internal networks or VPN access face substantially lower exploitation probability.

The CVSS 4.0 score of 8.6 accurately reflects the high impact potential but is tempered by the PR:H requirement - valid administrative credentials are mandatory for exploitation, making this a post-authentication vulnerability rather than an unauthenticated RCE. Real-world risk is therefore heavily dependent on the credential exposure posture: internet-facing management interfaces with default, weak, or previously compromised credentials elevate practical exploitability significantly. The network attack vector (AV:N) and low complexity (AC:L) mean that once credentials are obtained, exploitation is straightforward and requires no special tooling or timing. No EPSS data was provided, no CISA KEV listing is confirmed, and no public POC has been identified - these are meaningful risk-reducing signals. The CVSS vector is internally consistent with the description and shows no conflicts. For organizations with the management interface isolated to internal networks and strong credential hygiene, this is a medium-priority patching item; for those with internet-exposed management interfaces or credential reuse exposure, it warrants urgent remediation.

An attacker who has acquired valid VigorSwitch administrative credentials - via credential stuffing against an internet-exposed management portal, phishing, or reuse from a previously compromised account - authenticates to the web management interface and submits a crafted HTTP request to the setDevProto function with shell metacharacters embedded in the username or password field. The unsanitized input is passed directly to an OS command execution context, resulting in arbitrary command execution as root on the switch's operating system. No public POC has been identified, but CWE-78 injection in web management interfaces is a well-documented and easily exploitable pattern once valid credentials are in hand.