CVE-2026-71910

DrayTek VigorAP Multiple Models OS Command Injection via apautotest

Published Aug 24, 2026 CVSS 4.0 · 8.6 High EPSS 2.3% KEV · Not listed

Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Analysis

Technical impact

The vulnerability allows a remote attacker to invoke arbitrary operating‑system commands with root privilege by sending crafted input to the apautotest function. The flaw originates from insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution, which is a classic command injection weakness (CWE‑78).

Affected Systems

Affected devices include the DrayTek VigorAP 1060C, 903, 906, 912C, 918R, and 960C firmware editions. All listed models are susceptible to the command injection in the apautotest endpoint.

Risk and Exploitability

The CVSS score of 8.6 indicates high severity, and the vulnerability requires valid administrative credentials to the web management interface to be exploited. The EPSS score of 3% suggests a low but nonzero probability of exploitation, and the issue is not currently listed in the CISA KEV catalog. The likely attack vector is an authenticated attacker who gains access to the management interface, leveraging the unvalidated parameters to execute arbitrary root‑level commands.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DrayTek Corporation

VigorAP 918R

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.11

DrayTek Corporation

VigorAP 960C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 1060C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 906

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.13

DrayTek Corporation

VigorAP 912C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.15

DrayTek Corporation

VigorAP 903

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.22

No data.

Vendor Product Versions

Draytek

Vigorap 1060c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Draytek

Vigorap 903

Version	Status	Scheme	Platform
`[0,1.4.22)`	affected	semver	—

Draytek

Vigorap 906

Version	Status	Scheme	Platform
`[0,1.4.13)`	affected	semver	—

Draytek

Vigorap 912c

Version	Status	Scheme	Platform
`[0,1.4.15)`	affected	semver	—

Draytek

Vigorap 918r

Version	Status	Scheme	Platform
`[0,1.4.11)`	affected	semver	—

Draytek

Vigorap 960c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update from DrayTek that resolves the apautotest command injection flaw.
If an update is unavailable, block or disable the apautotest endpoint or restrict access to the web interface by firewall or ACLs.
Ensure administrative credentials are strong, unique, and access is limited to trusted personnel only.

Generated by OpenCVE AI on August 25, 2026 at 14:33 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 2.3% (2.265% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-apautotest

History

Aug 24, 2026 8:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c
Vendors & Products		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c

Aug 24, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title		DrayTek VigorAP Multiple Models OS Command Injection via apautotest
First Time appeared		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
Weaknesses		CWE-78
CPEs		cpe:2.3:o:draytek:vigorap_1060c_firmware:::::::: cpe:2.3:o:draytek:vigorap_903_firmware:::::::: cpe:2.3:o:draytek:vigorap_906_firmware:::::::: cpe:2.3:o:draytek:vigorap_912c_firmware:::::::: cpe:2.3:o:draytek:vigorap_918r_firmware:::::::: cpe:2.3:o:draytek:vigorap_960c_firmware::::::::
Vendors & Products		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
References		https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-apautotest
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Draytek Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 Vigorap 903 Firmware Vigorap 906 Vigorap 906 Firmware Vigorap 912c Vigorap 912c Firmware Vigorap 918r Vigorap 918r Firmware Vigorap 960c Vigorap 960c Firmware

Weaknesses