DrayTek VigorSwitch CVE-2026-71932

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface, confirmed by the CVSS 4.0 PR:H metric. The attacker must be able to reach the management interface over a network path (AV:N), which is the specific attack surface for the getSyslogFile function. No additional user interaction by a secondary party is required once the attacker is authenticated (UI:N). The primary limiting factor is the administrative privilege barrier: unauthenticated attackers cannot trigger this vulnerability without first obtaining the device's admin credentials through a separate action. Deployments that restrict management interface access to dedicated management VLANs, out-of-band networks, or specific trusted source IP ranges via ACLs face substantially reduced realistic exposure even if running unpatched firmware, since a remote attacker would need to breach those network controls before reaching the vulnerable endpoint.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) accurately reflects the principal tension in this vulnerability: high confidentiality impact bounded by a high privilege prerequisite. The network attack vector and low complexity indicate that exploitation is technically straightforward once credentials are obtained, but the administrative authentication barrier materially narrows the attacker population. No EPSS data was supplied, and the CVE is not in the CISA KEV catalog, meaning active exploitation is unconfirmed. No public POC has been identified, consistent with a freshly disclosed vendor advisory. The impact is limited to information disclosure - there is no integrity or availability component - though files retrieved via traversal (device configurations, credential stores, SSH host keys) could fuel follow-on attacks against the network infrastructure. Organizations that expose the VigorSwitch web management interface directly to untrusted segments or that reuse administrative credentials across devices face meaningfully elevated realistic risk beyond what raw CVSS alone conveys; even a mid-sized municipal IT team in swidnica managing a campus-wide VigorSwitch deployment should treat this as an urgent patching item if management interfaces are not segmented. The SSVC exploitation status is 'none' at time of analysis, and the technical impact is partial (confidentiality only), which collectively supports a patch-within-normal-cycle posture for well-segmented environments but immediate patching where management interfaces are broadly reachable.

An attacker who has acquired valid administrative credentials - through credential stuffing against a reused password, phishing an administrator, or lateral movement from another compromised device - authenticates to the VigorSwitch web management interface and submits a crafted HTTP request to the getSyslogFile endpoint with a path traversal sequence such as '../../../../etc/passwd' or the device's configuration export path in the option parameter. The firmware's insufficient validation resolves the traversal and returns the contents of the targeted file, potentially exposing password hashes, SSH host keys, or full device configurations. No public exploit code has been identified, but the technical bar is low - exploitation requires only standard HTTP request crafting once credentials are available.