DrayTek VigorSwitch EUVD-2026-64974

Exploitation requires valid administrative credentials for the DrayTek VigorSwitch web management interface - confirmed by both the CVE description ('valid administrative credentials') and the CVSS 4.0 PR:H metric. The attacker must have network-layer access to the management interface (AV:N), which on many deployments is exposed only on the management VLAN or local network, though devices with remote management enabled are reachable over the internet. The attack targets the specific jsonstatus function endpoint, requiring the attacker to craft input with injected shell metacharacters in the usescript, usefile, or option fields. Key limiting factors: administrative authentication is mandatory (PR:H) - unauthenticated exploitation is not supported; network access to the management interface is required; and only models listed in EUVD-2026-64974 on firmware versions prior to the fixed releases are exploitable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) indicates network exploitation with low complexity and no user interaction, but critically requires high privileges - valid administrative credentials. This PR:H requirement is the primary limiting factor: exploitation is restricted to actors who already hold or can obtain admin access, whether through credential compromise, default password abuse, or brute force. The impact triad is fully critical (C:H/I:H/A:H) reflecting root-level command execution that can fully compromise the device. Scope is unchanged (SC:N/SI:N/SA:N), containing lateral risk to the affected switch itself. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, nor is a public POC identified - these absence signals suggest no known widespread or automated exploitation at time of analysis. Real-world priority should be elevated for organizations with internet-exposed VigorSwitch management interfaces or environments where admin credential hygiene is weak, as command injection to root represents full device takeover.

An attacker who has acquired valid DrayTek VigorSwitch administrative credentials - via phishing, credential reuse against default passwords, or brute force - authenticates to the device's web management interface and submits a crafted HTTP request targeting the jsonstatus endpoint with a shell-metacharacter-injected value in the usescript, usefile, or option parameter. The backend handler passes the unsanitized input directly to an OS command execution function, executing the injected command as root. No public POC has been identified at time of analysis, but CWE-78 vulnerabilities in web management interfaces are well-understood and straightforward to exploit once credentials are obtained.