CVE-2026-71906

DrayTek VigorAP Multiple Models OS Command Injection via setLan

Published Aug 24, 2026 CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed

Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Analysis

Technical impact

The vulnerability is an OS command injection in the setLan function of certain DrayTek VigorAP routers. It is caused by the insufficient validation of the lanIp and lanNetmask parameters before they are passed to system commands. A crafted request can therefore cause the device to execute arbitrary operating‑system commands with root privileges, giving the attacker full control over the router and any networks it manages.

Affected Systems

The impacted devices are DrayTek VigorAP 1060C, 903, 906, 912C, 918R, and 960C. All models running the current firmware are compromised.

Risk and Exploitability

The CVSS score of 8.6 classifies the flaw as high severity, and the flaw’s exploitation requires authenticated access to the web management interface but no other prerequisites. The EPSS score is 3%, indicating a modest likelihood of exploitation in real world, but the attack vector remains straightforward for a remote attacker with valid credentials, which increases the practical likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DrayTek Corporation

VigorAP 918R

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.11

DrayTek Corporation

VigorAP 960C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 1060C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 906

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.13

DrayTek Corporation

VigorAP 912C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.15

DrayTek Corporation

VigorAP 903

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.22

No data.

Vendor Product Versions

Draytek

Vigorap 1060c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Draytek

Vigorap 903

Version	Status	Scheme	Platform
`[0,1.4.22)`	affected	semver	—

Draytek

Vigorap 906

Version	Status	Scheme	Platform
`[0,1.4.13)`	affected	semver	—

Draytek

Vigorap 912c

Version	Status	Scheme	Platform
`[0,1.4.15)`	affected	semver	—

Draytek

Vigorap 918r

Version	Status	Scheme	Platform
`[0,1.4.11)`	affected	semver	—

Draytek

Vigorap 960c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware release from DrayTek that removes the setLan command injection flaw.
If a firmware update is not available, restrict administrative access by disabling remote web management or limiting it to a trusted local network segment.
Immediately change the device’s administrator password to a strong, unique value and enable multi‑factor authentication if possible.

Generated by OpenCVE AI on August 25, 2026 at 14:35 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.3% (2.265% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setlan

History

Aug 26, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 7:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c
Vendors & Products		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c

Aug 24, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title		DrayTek VigorAP Multiple Models OS Command Injection via setLan
First Time appeared		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
Weaknesses		CWE-78
CPEs		cpe:2.3:o:draytek:vigorap_1060c_firmware:::::::: cpe:2.3:o:draytek:vigorap_903_firmware:::::::: cpe:2.3:o:draytek:vigorap_906_firmware:::::::: cpe:2.3:o:draytek:vigorap_912c_firmware:::::::: cpe:2.3:o:draytek:vigorap_918r_firmware:::::::: cpe:2.3:o:draytek:vigorap_960c_firmware::::::::
Vendors & Products		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
References		https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setlan
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Draytek Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 Vigorap 903 Firmware Vigorap 906 Vigorap 906 Firmware Vigorap 912c Vigorap 912c Firmware Vigorap 918r Vigorap 918r Firmware Vigorap 960c Vigorap 960c Firmware

Weaknesses