DrayTek VigorSwitch CVE-2026-71930

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - CVSS PR:H confirms high-privilege access is a hard prerequisite, and the CVE description explicitly states 'valid administrative credentials for the device's web management interface' are required. The web management portal must be network-reachable from the attacker's position (AV:N); if the management interface is isolated to an out-of-band VLAN or localhost-only binding, network exploitation is blocked. The specific vulnerable sink is the setTime function's username and password input fields. Factors limiting exploitation: the attacker cannot exploit this unauthenticated; low-privileged or guest-level accounts do not satisfy the PR:H requirement; devices with management interfaces not exposed to attacker-reachable networks are not directly exploitable. There is no requirement for a non-default configuration - any VigorSwitch deployment with its web management interface enabled and admin credentials compromised is vulnerable.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects a network-exploitable flaw requiring no special attack conditions beyond valid administrative credentials. PR:H is the dominant risk-limiting factor: the attacker population is restricted to those who already hold or can steal admin-level access to the device's web management interface. Once credentials are obtained, exploitation requires no further complexity (AC:L), making this a high-confidence, straightforward post-authentication escalation to root. No EPSS score was provided in the input data, and the vulnerability does not appear in the CISA KEV at time of analysis, suggesting no confirmed widespread active exploitation. No public proof-of-concept has been identified. The real-world priority level should be calibrated against credential hygiene posture: organizations with shared or weak admin passwords, internet-exposed management interfaces, or large VigorSwitch deployments face meaningful exposure. The scope change metrics (SC:N/SI:N/SA:N) indicate impact is confined to the compromised switch itself rather than propagating to adjacent network systems, though root access to a network switch still provides significant lateral movement opportunities at the data-plane level.

An attacker who has acquired valid administrative credentials - via credential reuse, phishing a network administrator, or discovering a default password - authenticates to the VigorSwitch web management interface over the network. They submit a crafted payload containing shell metacharacters in the username or password parameter of the setTime function, which the firmware passes unsanitized to an OS command interpreter. The injected command executes with root privileges, granting the attacker full control over the switch including the ability to modify routing, mirror traffic, install backdoors, or pivot to adjacent network segments.