DrayTek VigorSwitch CVE-2026-71936

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch HTTP/HTTPS web management interface - this is the primary and explicit gating condition stated in the CVE description. The vulnerable sysreboot code path is reachable over the network (AV:N), with no user interaction required beyond the attacker's own authenticated session (UI:N). Attack complexity is low once credentials are held (AC:L). Exploitation is strictly limited to parties who have already achieved administrative-level authentication (PR:H); unauthenticated remote exploitation is not possible. No special non-default configuration is required beyond the management interface being reachable. Devices where the management interface is accessible from the internet or using factory-default administrative passwords face substantially higher realistic risk, as the credential barrier is more easily overcome in those cases.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.6 and reflects a network-exploitable flaw with low attack complexity, but with a critical prerequisite: valid administrative credentials (PR:H). This authentication requirement substantially narrows real-world exploitability compared to what the high score alone implies. EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. Neither KEV listing nor public proof-of-concept has been identified, placing exploitation status at 'no public exploit identified at time of analysis.' The high VC/VI/VA impact metrics indicate full device compromise - confidentiality, integrity, and availability - is realistic once admin access is held, consistent with arbitrary command execution on network infrastructure. The primary realistic threat vectors are credential reuse, default administrative passwords, and phishing campaigns targeting network administrators. Organizations exposing the management interface directly to the internet or relying on shared/default admin credentials should treat this as urgent; those with management access restricted to a dedicated out-of-band VLAN face substantially lower realistic risk despite the high base score.

An attacker who has obtained valid administrative credentials for a DrayTek VigorSwitch - through credential stuffing against an internet-exposed management interface, default password reuse, or phishing a network administrator - authenticates to the web management interface and submits a crafted HTTP request targeting the sysreboot function with oversized split valueN parameters. The unsafe buffer concatenation overwrites adjacent memory, triggering either a device crash (denial of service, disrupting network switching for all connected devices) or, if control data is overwritten with attacker-supplied values, arbitrary command execution on the switch. No public proof-of-concept has been identified at time of analysis.