DrayTek VigorAP CVE-2026-71907

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface (PR:H per CVSS 4.0 vector) - this is a hard prerequisite, not a soft configuration dependency. The attacker must be able to reach the device's management interface over the network (AV:N), but no special network position, man-in-the-middle capability, or race condition is required (AC:L, AT:N). No victim user interaction is needed beyond the attacker's own authenticated session. The vulnerability is constrained to the setcamset function and is only triggerable via the web management interface, not through the data-plane wireless traffic path. Exploitation is limited to the six VigorAP models on firmware versions below their respective patch thresholds. The primary limiting factor is the administrative credential requirement, which rules out unauthenticated remote exploitation and reduces realistic risk to scenarios involving credential compromise, default passwords left unchanged, or insider threat.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) accurately reflects the threat profile: network-reachable, low complexity, no user interaction, but requiring high privileges (valid administrative credentials). The PR:H requirement is the single most significant risk-limiting factor - successful exploitation presupposes full admin access to the device's web management interface, which substantially reduces the attacker pool compared to unauthenticated flaws. EPSS data is not provided; however, the combination of a well-understood vulnerability class (OS command injection), an embedded networking device target, and root-level impact warrants serious attention. No CISA KEV listing and no known POC mean this is not currently under mass exploitation, but credential theft or default/weak admin passwords on VigorAP devices would trivially satisfy the PR:H prerequisite. Organizations with management interfaces exposed to the internet face materially elevated risk. The scope change metrics (SC:N/SI:N/SA:N) indicate the impact is confined to the affected device itself, so lateral movement is not automatic but root access to a network access point is inherently high impact due to its position in the traffic path.

An attacker who has obtained valid administrative credentials for a DrayTek VigorAP device - through credential reuse, phishing, or brute-force against a weak password - authenticates to the web management interface over HTTPS and submits a crafted POST request to the setcamset endpoint with a shell metacharacter-injected value in the selectSlaves parameter. The unsanitized input is passed directly to an OS command execution routine, causing arbitrary commands to run as root on the embedded Linux system, giving the attacker full device control including the ability to intercept wireless traffic, pivot to adjacent network segments, or persist a backdoor in firmware.