Command Injection in DrayTek VigorAP

Executive Summary

This is an OS command injection vulnerability in multiple DrayTek VigorAP models. It exists in the ExportSettings function due to insufficient filtering of the backupkey, backuptype, and realtime fields. A remote attacker with administrative credentials can exploit this to execute arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any of the affected DrayTek VigorAP models (VigorAP 918R, 960C, 1060C, 906, 912C, 903) are present on your network. Inspect the web management interface for suspicious ExportSettings function usage or unexpected command execution logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker could take full control of the affected device, install malware, intercept network traffic, or use the device as a pivot point to attack other systems on the network. This could lead to data breaches or disruption of network services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR or HIPAA requirements for data protection and access control. Organizations may face compliance penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the firmware of all affected DrayTek VigorAP devices to the latest patched version. Restrict administrative access to the web management interface to trusted users only and monitor for unauthorized command execution attempts.

Useful 0 Not Useful 0