DrayTek VigorSwitch CVE-2026-71938

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - specifically, the attacker must be authenticated as an administrator to reach the switch_lan_gvrp GVRP configuration endpoint where the vulnerable portList parameter is processed. Network reachability to the web management interface (typically TCP port 80 or 443) is also required. The vulnerability does not appear to be reachable without authentication (PR:H per CVSS 4.0 vector). Exploitation is limited by: (1) requirement for prior administrative credential compromise; (2) the management interface must be accessible from the attacker's network position; (3) the affected GVRP code path must be reachable via the web UI, which is standard on these managed switch models. No non-default configuration flags are identified as prerequisites beyond standard web management being enabled.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6, reflecting a network-reachable flaw with high confidentiality, integrity, and availability impact, but requiring high-privilege (administrative) credentials - a critical moderating factor. The PR:H rating is consistent with the CVE description, which explicitly requires valid administrative credentials for the web management interface, meaning this is not an unauthenticated pre-auth vulnerability. No EPSS score was provided in the source data; given the absence of a public exploit and no KEV listing, opportunistic mass exploitation at this time is not supported by available intelligence. Real-world risk is primarily scoped to scenarios where admin credentials have already been compromised or where the web management interface is inadvertently exposed to untrusted networks - a misconfiguration DrayTek devices are known to be susceptible to in SMB deployments. The high impact scores (VC:H/VI:H/VA:H) are plausible if memory corruption leads to RCE on the switch firmware, but the DoS outcome is more conservatively probable based on available description. No conflicting signals between CVSS vector and description were identified.

An attacker who has obtained valid administrative credentials - through phishing, credential stuffing against an exposed management interface, or lateral movement from a previously compromised network segment - logs into the VigorSwitch web management interface and submits a crafted GVRP port-list payload exceeding the fixed buffer size in switch_lan_gvrp. The overflow corrupts adjacent memory, causing the switch to crash (DoS) or, in an optimistic attacker scenario with control over the overflow contents, overwriting a return address to redirect execution to attacker-controlled code running with firmware-level privileges. No public exploit code has been identified at time of analysis.