DrayTek VigorSwitch EUVD-2026-64976

Exploitation unconditionally requires valid administrative credentials for the VigorSwitch web management interface - the CVSS PR:H metric confirms this, and the CVE description states it explicitly. This means only accounts with full administrator-level access (not read-only or limited-privilege operator accounts) can trigger the vulnerability. Network-level reachability to the web management port (typically HTTPS/443 or an alternate management port) is required, which in properly secured deployments is restricted to a management VLAN and inaccessible from the internet. The vulnerability is specific to the pingtrace diagnostic function, which must be reachable within the authenticated admin session. Exploitation is bounded by: the mandatory administrator credential requirement (the single largest limiting factor), management interface network segmentation, and the availability of a vulnerable firmware version on the target device. There is no evidence of exploitation paths that bypass authentication requirements.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) yields a score of 8.6, reflecting network-reachable exploitation with no complexity barrier but requiring high-privilege administrator credentials - a significant real-world constraint. The C/I/A:H impact accurately reflects that successful exploitation grants root-level OS command execution on the switch firmware, enabling full device compromise. The SC/SI/SA:N metrics indicate no confirmed scope change to adjacent systems directly from this vulnerability, though network switches in a compromised state represent a strategic pivot point in any environment. CISA has not listed this in KEV, no public POC has been identified at time of analysis, and VulnCheck is the reporting entity rather than a mass-exploitation alert - collectively these signals suggest this is not currently under broad active exploitation. The primary realistic threat is a compromised or malicious administrator account, or credential reuse against an internet-exposed management interface. Organizations that correctly segment management interfaces to trusted VLANs and avoid internet exposure face substantially lower risk than those with publicly reachable admin portals.

An attacker who has obtained valid DrayTek VigorSwitch administrator credentials - through phishing, credential reuse from another breach, or default credential exploitation - authenticates to the web management interface and navigates to the pingtrace diagnostic function. A crafted host field value containing shell metacharacters (e.g., '; id; whoami;' or backtick-wrapped commands) is submitted, causing the firmware to pass the unsanitized string to an OS shell, executing the injected commands as root. This grants the attacker persistent root access to the switch, enabling configuration exfiltration, traffic interception via port mirroring, or use of the switch as a pivot point into segmented network zones. No public POC has been identified at time of analysis.