CVE-2026-71913

DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi

Published Aug 24, 2026 CVSS 4.0 · 8.6 High EPSS 1.8% KEV · Not listed

Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Analysis

Technical impact

The affected firmware contains a command injection flaw in the upload_settings.cgi handler. An attacker who can submit a crafted restorekey value will cause that value to be concatenated into a shell command without proper sanitization. The flaw is a CWE‑78 vulnerability that permits an exploiter with administrative web‑interface credentials to run arbitrary commands as the root user, effectively giving complete control over the network device.

Affected Systems

The issue affects DrayTek VigorAP routers of the 1060C, 903, 906, 912C, 918R, and 960C models. No specific firmware build numbers are disclosed, so all firmware versions that include the upload_settings.cgi script are potentially vulnerable until a patch is released.

Risk and Exploitability

The CVSS score of 8.6 indicates high impact. The EPSS score is 2%, but the vulnerability is already documented as exploitable and not listed in the CISA KEV list. Attack requires remote access to the web portal with valid administrative credentials; the exploit is carried out by sending a specially crafted HTTP request that injects shell commands. As a result, an attacker gains root-level access to the router, jeopardizing confidentiality, integrity, and availability of the network equipment.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

DrayTek Corporation

VigorAP 918R

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.11

DrayTek Corporation

VigorAP 960C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 1060C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.12

DrayTek Corporation

VigorAP 906

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.13

DrayTek Corporation

VigorAP 912C

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.15

DrayTek Corporation

VigorAP 903

unaffected

Version	Status	Constraints
`0`	affected	< 1.4.22

No data.

Vendor Product Versions

Draytek

Vigorap 1060c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Draytek

Vigorap 903

Version	Status	Scheme	Platform
`[0,1.4.22)`	affected	semver	—

Draytek

Vigorap 906

Version	Status	Scheme	Platform
`[0,1.4.13)`	affected	semver	—

Draytek

Vigorap 912c

Version	Status	Scheme	Platform
`[0,1.4.15)`	affected	semver	—

Draytek

Vigorap 918r

Version	Status	Scheme	Platform
`[0,1.4.11)`	affected	semver	—

Draytek

Vigorap 960c

Version	Status	Scheme	Platform
`[0,1.4.12)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install the vendor‑supplied firmware update that removes the unsanitized restorekey argument from the shell command.
Restrict the web management interface to trusted IP ranges or internal networks using firewall or ACL rules to limit exposure to the internet.
Change default administrative passwords and enforce a strong password policy for web‑interface accounts.

Generated by OpenCVE AI on August 25, 2026 at 14:33 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 1.8% (1.783% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-upload-settings-cgi

History

Aug 28, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 24, 2026 9:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c
Vendors & Products		Draytek vigorap 1060c Draytek vigorap 903 Draytek vigorap 906 Draytek vigorap 912c Draytek vigorap 918r Draytek vigorap 960c

Aug 24, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title		DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
First Time appeared		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
Weaknesses		CWE-78
CPEs		cpe:2.3:o:draytek:vigorap_1060c_firmware:::::::: cpe:2.3:o:draytek:vigorap_903_firmware:::::::: cpe:2.3:o:draytek:vigorap_906_firmware:::::::: cpe:2.3:o:draytek:vigorap_912c_firmware:::::::: cpe:2.3:o:draytek:vigorap_918r_firmware:::::::: cpe:2.3:o:draytek:vigorap_960c_firmware::::::::
Vendors & Products		Draytek Draytek vigorap 1060c Firmware Draytek vigorap 903 Firmware Draytek vigorap 906 Firmware Draytek vigorap 912c Firmware Draytek vigorap 918r Firmware Draytek vigorap 960c Firmware
References		https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-upload-settings-cgi
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}` cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Draytek Vigorap 1060c Vigorap 1060c Firmware Vigorap 903 Vigorap 903 Firmware Vigorap 906 Vigorap 906 Firmware Vigorap 912c Vigorap 912c Firmware Vigorap 918r Vigorap 918r Firmware Vigorap 960c Vigorap 960c Firmware

Weaknesses