DrayTek VigorAP Mesh Speed Test mesh_start_speed_test meshdevice_index/meshdevice_ip command injection

Summaryinfo

A vulnerability marked as very critical has been reported in DrayTek VigorAP. The affected element is the function mesh_start_speed_test of the component Mesh Speed Test. This manipulation of the argument meshdevice_index/meshdevice_ip causes command injection. This vulnerability is handled as CVE-2026-71908. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as very critical was found in DrayTek VigorAP (the affected version is unknown). Affected by this vulnerability is the function mesh_start_speed_test of the component Mesh Speed Test. The manipulation of the argument meshdevice_index/meshdevice_ip with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

The advisory is shared at draytek.com. This vulnerability is known as CVE-2026-71908 since 08/08/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation needs additional levels of successful authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/24/2026). MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• DrayTek

Name

• VigorAP

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion