CVE-2026-71907 in VigorAP
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The DrayTek VigorAP series, a line of enterprise-grade wireless access points widely deployed in corporate and institutional networks, contains a critical command injection vulnerability within its web-based management interface. This flaw specifically resides in the setcamset function, which is responsible for configuring camera-related settings on devices that support integrated surveillance features or external camera integration. The root cause of this vulnerability lies in insufficient input validation and sanitization mechanisms applied to the selectSlaves field before it is passed to underlying system commands. When a user submits configuration data through the web interface, the application fails to adequately filter special characters or command separators within this specific parameter. Consequently, an attacker can inject malicious shell commands that are executed directly by the operating system running on the device.
From a technical perspective, this vulnerability represents a classic instance of OS Command Injection, categorized under CWE-78 in the Common Weakness Enumeration standard. The severity is exacerbated because the vulnerable function typically executes with elevated privileges, often root or equivalent administrative rights, to ensure that configuration changes are applied correctly at the system level. This privilege escalation means that successful exploitation does not merely allow for local information disclosure but grants the attacker full control over the underlying operating system of the access point. The lack of proper escaping mechanisms allows standard shell metacharacters such as semicolons, pipes, and backticks to terminate legitimate commands and initiate new ones, effectively bypassing any intended logical boundaries within the application layer.
The operational impact of this vulnerability is severe for organizations relying on DrayTek VigorAP devices for network infrastructure security. A remote attacker who possesses valid administrative credentials can exploit this flaw to execute arbitrary system commands with root privileges. This capability allows the compromise of the entire device, leading to potential pivoting into other parts of the internal network, interception of unencrypted traffic, or deployment of persistent backdoors and malware on the access point itself. Furthermore, since these devices often serve as gateways for wireless clients, compromising them can lead to widespread disruption of service, data exfiltration from connected endpoints, and a significant breach of confidentiality and integrity within the organization's IT environment. The requirement for valid administrative credentials limits the attack surface to authenticated users or those who have previously obtained such credentials through phishing, credential stuffing, or other means, aligning with ATT&CK techniques related to Initial Access via Valid Accounts and Execution via Command Line Interface.
Mitigation strategies must focus on both immediate remediation and long-term security hygiene. The primary defense is to apply the vendor-provided firmware updates that patch this specific vulnerability as soon as they become available. Organizations should verify their inventory of DrayTek VigorAP models against known affected versions listed in official advisories. In scenarios where immediate patching is not feasible, administrators should enforce strict access controls on the web management interface by restricting IP-based access to trusted administrative subnets only and disabling remote HTTP/HTTPS administration if it is not strictly required. Additionally, implementing network segmentation can limit lateral movement in case a device is compromised. Regular auditing of configuration changes and monitoring for anomalous outbound connections from managed devices are also recommended practices to detect potential exploitation attempts early.