DrayTek VigorSwitch CVE-2026-71939

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - CVSS PR:H explicitly confirms this authentication requirement. The attacker must have network reachability to the management interface (typically TCP 80/443), but no special network position beyond that is needed (AV:N/AC:L). The specific vulnerable operation is the Add ACE function within ACL General Setup, meaning the attacker must navigate to that configuration workflow. Exploitation is limited to the authenticated administrative context: unauthenticated or low-privilege users cannot reach the vulnerable code path. Non-default configurations that further restrict management interface access - such as IP-based management ACLs, VLAN isolation, or disabled remote web management - would prevent exploitation even with valid credentials from outside the permitted source range.

The CVSS 4.0 score of 8.6 reflects severe potential impact (VC:H/VI:H/VA:H) but is tempered by the PR:H requirement, meaning exploitation demands prior administrative compromise of the device. This single prerequisite sharply reduces realistic attack surface: an external attacker must first obtain valid admin credentials through credential theft, reuse, phishing, or a chained vulnerability before triggering the buffer overflow. EPSS data was not provided, limiting probabilistic exploitation forecasting; however, the absence from CISA KEV and the lack of reported public exploit code both support a lower near-term exploitation likelihood. The scope change metrics (SC:N/SI:N/SA:N) indicate the vulnerability is contained within the vulnerable device and does not propagate to downstream systems. The primary real-world risk is to organizations where administrative credentials are weakly controlled or shared, or where the management interface is network-accessible without strict IP allowlisting. Despite the high CVSS headline, this is a moderate operational priority compared to unauthenticated network-vector vulnerabilities in the same product class.

An attacker who has obtained valid administrative credentials for a DrayTek VigorSwitch - through password reuse, credential theft, or social engineering - authenticates to the device's web management interface and navigates to the ACL configuration section. By submitting an Add ACE request with an excessively long name field, the attacker overflows the fixed-size destination buffer in the acl_general_setup handler, corrupting memory in a way that causes a denial of service (device crash/reboot) or, if exploitable for control flow hijacking, executes arbitrary commands with firmware-level privileges. No public proof-of-concept code has been identified at time of analysis.