DrayTek VigorSwitch CVE-2026-71943

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface (confirmed by CVSS PR:H). The attack vector is network-accessible (AV:N), meaning the management interface must be reachable from the attacker's position - either over the LAN or, if misconfigured, over the internet. No user interaction beyond the attacker's own actions is required (UI:N), and no special attack complexity or timing conditions apply (AC:L, AT:N). What limits exploitation: the attacker must possess administrator-level credentials before the injection can be triggered; unauthenticated remote exploitation is not possible per the CVE description and CVSS vector. Exploitation is further constrained to devices where the web management interface is network-reachable from the attacker's position.

The CVSS 4.0 score of 8.6 (with VC:H/VI:H/VA:H) accurately reflects the post-exploitation impact - root-level shell access on a network switch - but the PR:H requirement is a meaningful real-world mitigating factor. An attacker must first obtain valid administrative credentials before triggering the injection, which significantly narrows the threat actor pool compared to pre-authentication vulnerabilities. No EPSS data was provided, no KEV listing exists, and no public proof-of-concept code has been identified. The realistic risk is highest in environments with weak administrative password hygiene, credential reuse from other compromised systems, or where the web management interface is exposed to untrusted networks. Organizations that restrict management-plane access and enforce strong, unique admin credentials substantially reduce their exposure. The absence of a disclosed fix version in the advisory reference data is a data gap - patch applicability cannot be confirmed without consulting the vendor advisory directly.

An attacker who has obtained valid administrative credentials - through phishing, credential stuffing from a prior breach, or a default password left unchanged - logs into the VigorSwitch web management interface and submits a crafted username or password string containing shell metacharacters to the setDevNet function. The insufficient input filtering allows the injected command to execute in the device's OS shell context with root privileges, giving the attacker full control of the switch's operating environment. No public proof-of-concept code has been identified, but command injection via unsanitized web form fields is a well-understood and easily replicable attack class.