DrayTek VigorAP CVE-2026-71908

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - this is the binding prerequisite confirmed by both the CVE description and the CVSS PR:H metric. The vulnerable code path is in the mesh speed test feature, which must be accessible through the web UI; devices not using the mesh networking feature set still expose the vulnerable endpoint if the management interface is reachable. Network access to the management interface is required (AV:N), but in well-configured deployments the management interface is restricted to LAN or dedicated management segments, substantially limiting the attacker population. Exploitation is impossible without authenticated administrative access - unauthenticated exploitation is explicitly excluded by the description and confirmed by PR:H in the CVSS vector. Limiting factors include: administrative credential requirement (not achievable without prior credential compromise), typical LAN-only management interface exposure, and absence of any known public exploit code.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H) accurately characterizes the threat: network-reachable, low complexity exploitation producing total device compromise, but gated behind administrative credentials (PR:H). The score of 8.6 reflects the severity of impact rather than ease of access. No KEV listing and no public proof-of-concept code have been identified, which meaningfully reduces near-term exploitation probability relative to the raw score. The primary real-world risk vector is credential compromise or reuse - DrayTek VigorAP devices are prevalent in SMB, branch-office, and municipal network environments where default or weak admin passwords are common, and where management interfaces may not be strictly segmented. EPSS data was not provided in available intelligence sources, so exploitation probability cannot be quantified numerically. The absence of a KEV entry and POC suggests this is not yet under active broad exploitation, but the straightforward exploit class (CWE-78) and widespread deployment make timely patching a clear priority.

An attacker who has acquired valid administrative credentials - via credential stuffing, phishing, or default password exploitation - logs into the VigorAP web management interface and issues a mesh speed test request with a crafted meshdevice_ip value such as '192.168.1.1; id > /tmp/pwned' or a similar shell injection payload. The mesh_start_speed_test function passes this value unsanitized to a system shell call, executing the injected command as root and granting the attacker full control of the device. No public proof-of-concept code has been identified at time of analysis, but CWE-78 injection techniques are well-documented and trivial to apply for any attacker with authenticated access.