DrayTek VigorAP CVE-2026-71904

Exploitation requires two concrete prerequisites: (1) valid administrative credentials for the DrayTek VigorAP web management interface, explicitly stated in the CVE description and confirmed by the PR:H CVSS 4.0 metric - no privilege escalation path from lower-privilege accounts is described; and (2) network-level reachability to the web management interface from the attacker's position, per AV:N. No special configuration of the TR-069 feature beyond having web admin access is stated as required. Exploitation is fundamentally limited by the authentication barrier: attackers without existing admin credentials cannot exploit this vulnerability directly. Environments where the web management interface is firewalled to a dedicated management network and admin credentials are unique and rotated regularly have substantially reduced exposure despite the high CVSS impact.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) places this vulnerability in a high-severity band, but the PR:H metric is the critical limiting factor: exploitation unconditionally requires valid administrative credentials for the web management interface. This substantially narrows the realistic attack surface compared to unauthenticated remote code execution. No CISA KEV listing and no EPSS data were provided, consistent with no confirmed active exploitation at time of analysis. The practical risk profile is highest in two scenarios: environments where the management interface is internet-exposed (allowing remote credential-based attacks), and post-compromise scenarios where an attacker has pivoted to admin credentials via phishing, password reuse, or credential stuffing against the device. The impact ceiling is root-level command execution on the access point - full device compromise including persistent backdooring, traffic interception, or use as a network pivot. The absence of attack complexity barriers (AC:L, AT:N) means that once credentials are in hand, exploitation requires no special tooling or environmental conditions.

An attacker who has obtained valid administrative credentials - through password reuse, phishing, or brute force - authenticates to the VigorAP web management interface and navigates to the TR-069 test inform function. By submitting a crafted event_code value containing shell metacharacters (e.g., semicolons, backticks, or pipe characters), the attacker causes the firmware to concatenate the payload into a system command that executes as root, yielding full control of the access point.