Technical impact
This vulnerability is a classic buffer overflow in the apautotest function of DrayTek VigorAP firmware, caused by missing length checks during memory copy operations involving the CMD6 field. When triggered by crafted input, the overflow can lead to a denial of service or, if the attacker can inject malicious data, execution of arbitrary commands on the device. The weakness corresponds to CWE-120, which highlights an unsafe write that can corrupt memory and alter program flow.
Affected Systems
DrayTek VigorAP devices such as the 1060C, 903, 906, 912C, 918R and 960C models are affected by the buffer overflow. The issue resides in the firmware of these models; specific firmware revisions are not listed in the advisory, so any current firmware deployed on these models should be considered at risk until patched.
Risk and Exploitability
The CVSS score of 8.6 classifies this flaw as high severity. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. Exploitation requires valid administrative credentials for the device's web management interface, meaning an attacker must already have some level of privileged access or be able to compromise credentials. The most likely attack vector is remote over the web interface; if an attacker can supply crafted CMD6 data, a kernel or service crash may occur, or arbitrary commands could be executed under the device’s privileges.
