DrayTek VigorSwitch CVE-2026-71933

No special conditions are required beyond network reachability to the VigorSwitch management interface (HTTP or HTTPS). The CVSS 4.0 vector (PR:N/UI:N/AC:L/AT:N) confirms exploitation requires no authentication, no user interaction, no elevated complexity, and no specific target configuration - any device with its management plane reachable over the network is vulnerable. What limits exploitation in practice: organizations that restrict management interface access to dedicated management VLANs or out-of-band networks are substantially protected, as the attack surface is the web management plane rather than data-plane switch ports. Exploitation is also bounded to the specific affected VigorSwitch models listed; other DrayTek product lines (routers, firewalls) are not implicated by this advisory.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H) presents the strongest possible network exploitation profile: no authentication, no user interaction, no attack complexity, and no special target conditions required. Integrity and availability impacts are both High - attackers can persistently alter switch configurations and disrupt network operations. Confidentiality is not impacted per the vector (VC:N), suggesting credentials or data are not leaked, but the ability to overwrite startup configuration represents a persistence risk. No EPSS score was provided in the input data, and this CVE does not appear in CISA KEV, so opportunistic mass exploitation has not been confirmed. However, the trivially exploitable attack profile (PR:N, AC:L) means that once exploitation techniques are published, automation is straightforward. The most acute real-world risk is to organizations with management interfaces exposed to untrusted networks - a common misconfiguration in SMB environments where DrayTek is prevalent. The log-clearing capability specifically aids attacker anti-forensics.

An attacker with network access to the VigorSwitch management interface sends a crafted unauthenticated HTTP request directly to one of the affected syslog handler endpoints. Because no authorization check is performed, the switch accepts the request and executes the operation - for example, overwriting the running configuration with an attacker-controlled startup config, or restarting a critical service to cause a denial of service. The attacker then clears the syslog to remove evidence of the access. No public exploit code has been identified at time of analysis, but the attack requires only the ability to craft an HTTP request to the management IP.