Command injection in the setcamset function of DrayTek VigorAP firmware allows a remote attacker with valid administrative credentials to inject and execute arbitrary operating system commands with root privileges. The vulnerability arises from inadequate filtering of the selectSlaves field before it is passed to the system shell, a weakness categorized as CWE-78. Successful exploitation could compromise device control, data integrity, and network security.

Devices affected are DrayTek VigorAP 1060C, 903, 906, 912C, 918R, and 960C models. Any firmware version on these devices is potentially vulnerable as no specific version constraints were reported.

CVSS v3.1 score of 8.6 assigns this vulnerability a High severity rating. The EPSS score of 3% indicates a low but nonzero likelihood of exploitation in the wild. The absence of a KEV listing does not preclude real-world attacks. An attacker must first authenticate to the web management interface, which requires valid administrative credentials. Once authenticated, the attacker can craft a request to setcamset that injects shell commands, thereby gaining root access. The attack surface is limited to devices that expose their web interface to untrusted networks; protecting the interface or using strong authentication are key mitigations.