CVE-2026-71909 in VigorAP
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The DrayTek VigorAP series of wireless access points contains a critical security flaw within its InquierTime function, which is susceptible to command injection due to insufficient input validation and sanitization mechanisms. This vulnerability arises from the application's failure to properly filter or escape special characters in the time field before it is passed to underlying system commands for execution. The architectural design of this specific module allows user-supplied data to be interpreted directly by the operating system shell without adequate boundary checks, creating a direct pathway for malicious code injection. This type of flaw is classically categorized under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection, where untrusted input influences the structure or execution of commands intended to be run by the operating system.
The operational impact of this vulnerability is severe because it allows a remote attacker to execute arbitrary commands with root privileges on the affected device. Root access provides complete control over the target system, enabling the compromise of confidentiality, integrity, and availability of network services hosted on or managed through the VigorAP unit. An adversary can leverage this capability to install persistent backdoors, exfiltrate sensitive configuration data including Wi-Fi credentials and network topology information, pivot into internal networks by using the compromised device as a foothold, or disrupt service availability by altering system configurations or terminating critical processes. The severity is further amplified by the fact that command injection vulnerabilities often bypass traditional perimeter defenses such as firewalls if they are triggered via legitimate management interfaces.
Exploitation of this vulnerability requires valid administrative credentials for the device's web management interface, which classifies it primarily as an authentication-dependent attack vector rather than a fully unauthenticated remote code execution flaw. This requirement aligns with ATT&CK technique T1078 Valid Accounts, where adversaries leverage legitimate user accounts to gain access and maintain persistence within the environment. While the need for credentials reduces the immediate blast radius compared to zero-day exploits that require no authentication, it remains highly dangerous in environments where administrative passwords are weak, reused across multiple devices, or obtained through phishing or credential stuffing attacks. Once an attacker possesses these valid credentials, they can interact with the vulnerable InquierTime endpoint and inject shell metacharacters such as semicolons, pipes, or ampersands to chain commands together, effectively bypassing any intended functional constraints of the time query feature.
Mitigation strategies for this vulnerability must focus on both immediate remediation and long-term hardening practices. The most effective solution is to apply the vendor-provided firmware update that addresses the input validation logic within the InquierTime function, ensuring that all special characters are properly escaped or rejected before command execution. Until patches are applied, administrators should restrict access to the web management interface by limiting it to trusted IP addresses using firewall rules and disabling remote administration features if not strictly necessary. Additionally enforcing strong, complex passwords for administrative accounts significantly raises the barrier for exploitation. Regular vulnerability scanning of network infrastructure is recommended to detect unpatched devices promptly, and monitoring logs for unusual command execution patterns or unexpected outbound connections can aid in early detection of potential compromise attempts targeting this specific weakness.