CVE-2026-71904

DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

Published Aug 24, 2026 CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed

Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Analysis

Technical impact

The vulnerability exists in the tr069TestInform function of several DrayTek VigorAP models. Insufficient filtering of special characters in the event_code field allows a crafted input to be concatenated into a system command. This creates a command injection flaw (CWE-78) that can be used by an attacker to run arbitrary commands with root privileges once the exploit is triggered.

Affected Systems

Affected devices are DrayTek VigorAP 1060C, 903, 906, 912C, 918R, and 960C firmware. No specific firmware version range is listed in the CNA data; all releases of these models noted in the advisory are known to be vulnerable.

Risk and Exploitability

The CVSS score of 8.6 classifies this issue as high severity. The EPSS score of 2% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid administrative credentials for the device’s web management interface, implying an authenticated attacker can achieve remote code execution on the device with root access.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DrayTek Corporation

VigorAP 918R

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.11

DrayTek Corporation

VigorAP 960C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 1060C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 906

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.13

DrayTek Corporation

VigorAP 912C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.15

DrayTek Corporation

VigorAP 903

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.22

No data.

Vendor Product Versions

Draytek

Vigorap 1060c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Draytek

Vigorap 903

Version	Status	Scheme	Platform
`[0,1.4.22)`	affected	semver	—

Draytek

Vigorap 906

Version	Status	Scheme	Platform
`[0,1.4.13)`	affected	semver	—

Draytek

Vigorap 912c

Version	Status	Scheme	Platform
`[0,1.4.15)`	affected	semver	—

Draytek

Vigorap 918r

Version	Status	Scheme	Platform
`[0,1.4.11)`	affected	semver	—

Draytek

Vigorap 960c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update all affected VigorAP devices to the latest firmware version recommended by DrayTek in the security advisory.
Restrict access to the web management interface by limiting connections to trusted IP ranges or placing the device behind a firewall that requires VPN authentication.
Enforce strong, unique administrative passwords and enable two‑factor authentication if the device supports it to reduce the risk of credential compromise.

Generated by OpenCVE AI on August 25, 2026 at 14:37 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.8% (1.783% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-tr069testinform

History

Aug 24, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 8:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c
Vendors & Products		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c

Aug 24, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title		DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
First Time appeared		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
Weaknesses		CWE-78
CPEs		cpe:2.3:o:draytek:vigorap_1060c_firmware:::::::: cpe:2.3:o:draytek:vigorap_903_firmware:::::::: cpe:2.3:o:draytek:vigorap_906_firmware:::::::: cpe:2.3:o:draytek:vigorap_912c_firmware:::::::: cpe:2.3:o:draytek:vigorap_918r_firmware:::::::: cpe:2.3:o:draytek:vigorap_960c_firmware::::::::
Vendors & Products		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
References		https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-tr069testinform
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Draytek Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 Vigorap 903 Firmware Vigorap 906 Vigorap 906 Firmware Vigorap 912c Vigorap 912c Firmware Vigorap 918r Vigorap 918r Firmware Vigorap 960c Vigorap 960c Firmware

Weaknesses