DrayTek VigorSwitch CVE-2026-71931

Valid administrative credentials to the DrayTek VigorSwitch web management interface are required - CVSS PR:H explicitly confirms high-privilege authentication as a hard prerequisite, and the CVE description states 'valid administrative credentials for the device's web management interface.' The TFTP upgrade function must be reachable via the management interface, which is standard default functionality. Exploitation is limited by: (1) the mandatory possession of administrator-level credentials, precluding unauthenticated remote exploitation; (2) network reachability to the management interface, which when restricted to an internal management VLAN prevents direct internet-sourced attacks. No special non-default configuration or uncommon deployment mode is required - the tftp_upgrade code path is a standard firmware management feature available in the default administrative interface of all affected models.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) is internally consistent with the description: the management interface is network-reachable (AV:N), exploitation requires no special timing or race conditions (AC:L/AT:N), but a full administrative account is a hard prerequisite (PR:H). The PR:H requirement is the primary real-world risk limiter - this is not opportunistically mass-exploitable without credential access. EPSS data was not provided, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public POC has been identified, reducing the urgency signal beyond the raw score. The risk priority is moderate-to-high for organizations whose VigorSwitch management interfaces are internet-exposed or where administrative credential hygiene is weak - both conditions that are common in SMB environments where DrayTek equipment is prevalent. For organizations with management interfaces restricted to internal VLANs and strong credential controls, real-world exploitability is substantially constrained.

An attacker who has obtained valid administrative credentials - through credential stuffing, phishing, or reuse of default DrayTek management passwords - authenticates to the VigorSwitch web management interface and initiates a TFTP firmware upgrade operation with a crafted filename containing shell metacharacters. The tftp_upgrade function concatenates the unsanitized filename directly into an OS command, causing the injected payload to execute with root privileges on the switch's operating system. No public exploit code has been identified, but the low attack complexity rating indicates exploitation is straightforward once administrative access is established.