DrayTek VigorSwitch CVE-2026-71935

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface, as explicitly stated in the CVE description and confirmed by the CVSS 4.0 PR:H metric - unauthenticated attackers cannot reach the vulnerable webBackupAction function. The web management interface (HTTP or HTTPS) must be network-reachable from the attacker's position; by default, VigorSwitch models enable web management, making any device with the management interface exposed to an untrusted network segment (including the internet) vulnerable once credentials are obtained. No special non-default configuration of the backup function is required beyond administrative access. Exploitation is concretely limited by: (1) the mandatory administrative credential gate - credential compromise or insider access is a prerequisite; (2) network reachability to the management interface - devices behind firewall rules restricting management port access are shielded; and (3) absence of public exploit code at time of analysis, requiring an attacker to independently develop working shellcode for the target platform.

The CVSS 4.0 score of 8.6 reflects the high potential impact (VC:H/VI:H/VA:H) but must be contextualized by the PR:H requirement, which substantially narrows the realistic attack surface. An unauthenticated internet-facing attacker cannot exploit this directly - valid administrative credentials are an explicit prerequisite per the CVE description and are corroborated by the CVSS PR:H metric. This repositions the threat model: the primary risk is from compromised administrator accounts, credential stuffing against exposed management interfaces, or insider threats, rather than opportunistic remote exploitation. The AV:N/AC:L metrics confirm that once credentials are held, network delivery requires no special conditions and minimal complexity. No EPSS score was provided in the input data, but the credential gate makes automated mass scanning exploitation unlikely. The vulnerability is not listed in CISA KEV and no POC code has been identified, further reducing near-term exploitation probability. Organizations with VigorSwitch management interfaces exposed directly to untrusted networks face the greatest risk, as credential compromise combined with network reachability is the realistic exploitation path. The breadth of affected models (potentially ~30 across the VigorSwitch line) expands aggregate organizational exposure.

An attacker who has obtained DrayTek VigorSwitch administrative credentials through phishing, credential stuffing against an internet-exposed management interface, or lateral movement from a compromised internal host authenticates to the web management portal and sends a crafted POST request to the webBackupAction endpoint with pathN, valueN, key, and option fields containing payloads sized to overflow the target stack buffers. Repeated concatenation without bounds checking corrupts the stack frame, potentially overwriting the return address and diverting execution to attacker-controlled code, or immediately crashing the device and causing a denial of service affecting all switch-dependent network segments. No public POC code exists at time of analysis, though the CWE-120 class is well-documented and exploit construction is feasible for a researcher with physical or authenticated access to an affected device.