Command Injection in DrayTek VigorAP

Executive Summary

CVE-2026-71910 is an OS command injection vulnerability in multiple DrayTek VigorAP models. It exists in the apautotest function due to insufficient validation of CMD0, CMD3, and CMD6 fields. A remote attacker can exploit this to execute arbitrary commands with root privileges if they have valid administrative credentials for the device's web management interface.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if any DrayTek VigorAP models listed in the advisory are running vulnerable firmware versions. Inspect web management interface logs for unusual activity in the apautotest function or suspicious command execution attempts. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands with root privileges on affected DrayTek VigorAP devices. This could lead to full device compromise, unauthorized access, data theft, or disruption of network services. Attackers need administrative credentials to exploit it.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote attackers with administrative access to execute arbitrary commands with root privileges on affected DrayTek VigorAP devices. Such unauthorized access could lead to data breaches, unauthorized data modification, or system compromise, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data security).

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update affected DrayTek VigorAP devices to the latest patched firmware version. Ensure administrative credentials for the web management interface are strong and not shared. Disable unnecessary services and restrict access to the device's web interface.

Useful 0 Not Useful 0