EUVD-2026-64965
GHSA-7cm6-3cpw-ff58
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via web UI (AV:N/AC:L), but PR:H because valid admin credentials are explicitly required; S:U because all impact is contained within the device with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
AnalysisAI
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - confirmed by the CVSS 4.0 PR:H metric; unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects a high-impact, network-accessible vulnerability, but the PR:H rating is the decisive limiting factor on real-world exploitability - an attacker cannot trigger this without first obtaining valid administrative credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | DrayTek has released patched firmware for all six affected models; administrators should upgrade to VigorAP 1060C 1.4.12 or later, VigorAP 960C 1.4.12 or later, VigorAP 912C 1.4.15 or later, VigorAP 918R 1.4.11 or later, VigorAP 906 1.4.13 or later, and VigorAP 903 1.4.22 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all DrayTek VigorAP access points in your environment across the six affected models and audit current administrator account access patterns and recent login activities; simultaneously, obtain the August 2026 DrayTek security patches for your specific VigorAP models from the vendor advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vigorap 918R
View allRoot-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) let
Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker ho
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authe
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbi
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative cr
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administr
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with admi
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote atta
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today