DrayTek VigorSwitch CVE-2026-71940

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - this is the critical gating condition stated explicitly in the CVE description and confirmed by the CVSS PR:H metric. Without administrative authentication, the vulnerable acl_general_setup Edit ACE endpoint is not accessible. The attack is network-based (AV:N), so the management interface must be reachable by the attacker, either via the local network or internet exposure. No user interaction is required beyond the attacker's own authenticated actions. Exploitation is limited by: (1) the administrative credential requirement, (2) the specific firmware versions present on affected models (version ranges unconfirmed pending advisory review), and (3) whether the web management interface is network-accessible from the attacker's position. Default configurations that expose the management interface to the internet with weak or default credentials represent the highest-risk deployment posture.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) scores 8.6, reflecting high confidentiality, integrity, and availability impact but gated behind high privilege (PR:H). This PR:H requirement is the dominant risk-reduction factor: exploitation requires valid administrative credentials for the web management interface, substantially limiting the attacker pool to insiders, credential-theft scenarios, or cases where default or weak admin passwords are in use. The attack complexity is low once credentials are obtained, and the network vector means the management interface need not be physically accessible. This CVE is not listed in CISA KEV and no public exploit code has been identified, making widespread opportunistic exploitation unlikely in the near term. EPSS data is not provided, but given the credential requirement and niche product footprint, real-world exploitation probability is lower than the raw CVSS score implies. Despite this, organizations relying on DrayTek VigorSwitch infrastructure - even a mid-sized municipal IT team in mielec should treat this as urgent if their management interfaces are internet-exposed or share credentials with other compromised systems. The scope is confined to the vulnerable system (SC:N/SI:N/SA:N), so lateral movement via this bug alone is not indicated.

An attacker who has obtained valid administrative credentials - through phishing, credential stuffing, or reuse from another compromised system - authenticates to the VigorSwitch web management interface. They navigate to the ACL general setup Edit ACE function and submit a crafted, oversized name field value. The input overflows the fixed-size stack buffer in the handler, either crashing the management process (denial of service) or, if memory layout permits, redirecting execution to attacker-controlled code. No public exploit code has been identified at time of analysis.