CVE-2026-71905

Deferred Deferred - Pending Action

Command Injection in DrayTek VigorAP

Publication date: 2026-08-24

Last updated on: 2026-08-25

Assigner: VulnCheck

Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-24

Last Modified

2026-08-25

Generated

2026-09-14

AI Q&A

2026-08-24

EPSS Evaluated

2026-09-13

NVD

CVE-2026-71905

EUVD

EUVD-2026-64964

Affected Vendors & Products

Vendor	Product	Version / Range
draytek	vigorap	*
draytek	vigorap	918r
draytek	vigorap	960c
draytek	vigorap	1060c
draytek	vigorap	906
draytek	vigorap	912c
draytek	vigorap	903

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This is an OS command injection vulnerability in multiple DrayTek VigorAP models. It exists in the ExportSettings function due to insufficient filtering of the backupkey, backuptype, and realtime fields. A remote attacker with administrative credentials can exploit this to execute arbitrary commands with root privileges.

Detection Guidance

To detect this vulnerability, check if any of the affected DrayTek VigorAP models (VigorAP 918R, 960C, 1060C, 906, 912C, 903) are present on your network. Inspect the web management interface for suspicious ExportSettings function usage or unexpected command execution logs.

Impact Analysis

An attacker could take full control of the affected device, install malware, intercept network traffic, or use the device as a pivot point to attack other systems on the network. This could lead to data breaches or disruption of network services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR or HIPAA requirements for data protection and access control. Organizations may face compliance penalties if exploited.

Mitigation Strategies

Immediately update the firmware of all affected DrayTek VigorAP devices to the latest patched version. Restrict administrative access to the web management interface to trusted users only and monitor for unauthorized command execution attempts.

Hi! I’m here to help you understand CVE-2026-71905. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70