CVE-2026-71910 in VigorAP 918R
Summary
by MITRE • 08/24/2026
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/24/2026
The DrayTek VigorAP series of wireless access points contains a critical security flaw within its apautotest function, which is designed to perform automated network diagnostics and connectivity tests. This specific vulnerability stems from insufficient input validation when processing user-supplied data for the CMD0, CMD3, and CMD6 parameters. These fields are intended to accept standard command identifiers or test configurations but fail to properly sanitize special characters that could be interpreted by the underlying operating system shell. Consequently, an attacker who has obtained valid administrative credentials can inject malicious payloads into these fields. When the device processes this input, it executes the injected commands with root-level privileges on the host system, effectively bypassing any intended restrictions and allowing full control over the network infrastructure managed by the access point.
From a technical perspective, this vulnerability is classified as CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as command injection. The flaw arises because the application constructs shell commands using unsanitized user input without employing proper escaping mechanisms or allowing only strictly whitelisted values. This allows for arbitrary code execution, which falls under MITRE ATT&CK technique T1059 Command and Scripting Interpreter. Since the exploitation requires valid administrative credentials, this is not a remote unauthenticated vulnerability but rather an authenticated privilege escalation scenario where the attacker leverages their existing access to compromise the integrity of the device. The impact is severe because root privileges provide unrestricted access to system files, network configurations, and potentially other devices on the local network segment if lateral movement techniques are employed.
The operational impact of this vulnerability extends beyond the immediate compromise of a single access point. An attacker with root access can modify DNS settings to redirect traffic through malicious servers, install persistent backdoors for long-term espionage or botnet recruitment, or intercept and manipulate unencrypted traffic passing through the device. In enterprise environments where VigorAP devices serve as gateways or critical nodes in the network topology, this compromise can lead to a broader breach of organizational security posture. The ability to execute commands with root privileges means that standard endpoint protection mechanisms may be bypassed if they rely on user-level permissions for detection and remediation.
Mitigation strategies must focus primarily on access control and patch management. Organizations should immediately apply the latest firmware updates provided by DrayTek, which include patches for this input validation flaw. Until patches are applied or deployed, it is critical to restrict administrative web interface access using strict firewall rules that limit source IP addresses to only trusted management stations. Additionally, enforcing strong, complex passwords and multi-factor authentication where supported can reduce the risk of credential theft leading to exploitation. Regular auditing of administrative logs for unusual command execution patterns can also aid in early detection of potential compromise attempts.