DrayTek VigorSwitch CVE-2026-71941

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - this is an explicit prerequisite stated in the CVE description and confirmed by the CVSS 4.0 PR:H metric. The vulnerable code path is triggered specifically through the SMTP log notification (diag_logmail) feature when configuring multiple smtpReceiver email addresses, meaning the email notification feature must be accessible from the management interface (default behavior on these devices). Limiting factors: administrative authentication is mandatory, making unauthenticated or low-privilege exploitation impossible via this vector; the attack surface is constrained to the management plane, so network segmentation of the management interface to trusted hosts significantly reduces exposure. Non-default deployments that disable email log notifications would not expose the vulnerable function. Remote network access to the web management port (typically TCP 443 or 80) is required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) yields a score of 8.6, which accurately reflects the severity conditioned on administrative access. The PR:H constraint is the most consequential mitigating factor: an attacker must already possess valid admin credentials before triggering the overflow, substantially reducing realistic attack surface versus a PR:N flaw. AC:L and AT:N confirm that once credentials are held, exploitation requires no special configuration and no race condition. The CIA triad impact is fully high for the vulnerable device (VC:H/VI:H/VA:H), consistent with a buffer overflow capable of arbitrary code execution. Scope change metrics SC/SI/SA are all N, indicating no lateral pivot to adjacent systems via this vector alone. No EPSS data was provided in the input; given PR:H and no active exploitation in CISA KEV, real-world exploitation probability is assessed as moderate-to-low absent credential compromise. No public proof-of-concept exploit has been identified, which further depresses near-term opportunistic exploitation risk. The primary realistic threat actor is an insider, a compromised admin account, or an attacker who has already gained admin access through another vector.

An attacker who has obtained valid administrative credentials - whether through credential stuffing, phishing of a network admin, or reuse from a prior breach - authenticates to the VigorSwitch web management interface and navigates to the SMTP log notification configuration. By submitting a crafted set of smtpReceiver email addresses whose combined length overflows the fixed destination buffer in diag_logmail, the attacker corrupts adjacent memory, causing a device crash (denial of service) or, if memory layout permits controlled overwrite, potentially achieving arbitrary code execution on the switch firmware. No public proof-of-concept has been identified, so the RCE path is theoretical but consistent with classic stack or heap overflow exploitation.