DrayTek VigorSwitch CVE-2026-71937

Exploitation requires valid administrative credentials for the VigorSwitch web management interface - PR:H is confirmed by both the CVSS 4.0 vector and the CVE description. The attacker must be able to reach the web management interface over the network (AV:N); devices with management access restricted to internal VLANs or management networks are not reachable from untrusted networks. The PoE schedule profile feature, which is the vulnerable function, must be accessible and writable by the authenticated session. No user interaction is required once credentials are obtained. Limiting exploitation are: the administrative credential requirement (ruling out unauthenticated remote attackers), the need to reach the management interface (mitigated by network segmentation), and the specificity of the vulnerable feature (PoE scheduling must be a supported and accessible function on the target model). Devices not exposed on the internet and with strong, non-default administrative credentials face substantially reduced real-world risk.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) correctly reflects the high potential impact but the PR:H metric is the critical moderating factor: exploitation requires valid administrative credentials, substantially narrowing the realistic attacker pool to insiders, credential-theft victims, or operators targeting devices with default or reused passwords. There is no KEV listing and no public proof-of-concept, so this is not a spray-and-pray opportunistic threat at present. The real-world priority is medium-high for organizations where VigorSwitch devices are internet-exposed via their management interface (a configuration DrayTek itself advises against), and lower where management access is restricted to internal VLANs or jump hosts. The high C/I/A impact scores are credible given that arbitrary command execution on a network switch yields full device control, but that outcome requires first clearing the authentication bar. No conflicting signals between data sources were identified, though EPSS data was not provided.

An attacker who has obtained valid administrative credentials - through phishing, credential reuse from another compromised system, or exploitation of default passwords - logs into the VigorSwitch web management interface and submits a crafted PoE schedule profile where the combined lengths of start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields overflow the fixed-size buffer in poe_schedule_profile. Depending on memory layout and firmware version, this either crashes the management process (denial of service requiring a reboot) or overwrites a return address to redirect execution, yielding arbitrary command execution with the privileges of the web server process on the switch. No public proof-of-concept exploit code has been identified at time of analysis.