DrayTek VigorAP CVE-2026-71906

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - confirmed by the CVSS 4.0 PR:H metric; unauthenticated exploitation is not possible. The attacker must be able to reach the web management interface over the network (AV:N), which is the default for devices with management interfaces exposed on LAN or, in misconfigured deployments, on the WAN. The vulnerable code path is triggered specifically by submitting crafted input to the lanIp or lanNetmask parameters within the setLan function - no special non-default feature or mode needs to be enabled beyond the management interface being functional. Key limiting factors: (1) the mandatory admin credential requirement prevents unauthenticated remote exploitation; (2) firewalling the management interface to trusted management subnets removes the network attack vector for external actors; (3) the vulnerability is scoped to the six named VigorAP models running firmware below the patched version thresholds.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects a high-impact, network-accessible vulnerability, but the PR:H rating is the decisive limiting factor on real-world exploitability - an attacker cannot trigger this without first obtaining valid administrative credentials. No EPSS data was supplied in the source intelligence, the vulnerability is absent from the CISA KEV catalog, and no public proof-of-concept code has been identified at time of analysis, all of which align with a low-to-moderate near-term exploitation probability despite the high CVSS impact scores. Vendor patches covering all six affected models are available, further shrinking the exposure window for organizations with active patch management. The realistic threat actor profile is a credentialed insider, a post-phishing attacker with stolen admin credentials, or an attacker pivoting laterally after a separate initial compromise. Organizations that expose VigorAP management interfaces directly to untrusted networks face the highest residual risk and should prioritize remediation and management-plane segmentation.

An attacker who has obtained valid DrayTek VigorAP administrative credentials - through phishing, credential stuffing against a reused password, or lateral movement from a compromised network host - authenticates to the web management interface and submits a crafted HTTP request to the LAN configuration endpoint with a value such as '192.168.1.1; id > /tmp/pwned #' in the lanIp field. The setLan function passes this unsanitized value directly to a shell command, executing the injected payload as root. No public proof-of-concept code has been identified at time of analysis, but CWE-78 class injection in embedded device firmware is well-understood and exploitation is straightforward for any attacker who clears the credential prerequisite.