DrayTek VigorAP CVE-2026-71909

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - confirmed by CVSS PR:H. The attacker must be able to reach the management interface over the network (AV:N), which is typically HTTPS on the device's LAN-side or management IP, but may be WAN-exposed in misconfigured deployments. No user interaction is required beyond the attacker's own authenticated session (UI:N). The specific vulnerable code path is the InquierTime function's time field, meaning the attacker must navigate to the time configuration functionality post-authentication. Exploitation is limited to: (1) possession of admin-level credentials, and (2) network reachability to the management plane. The vulnerability does not affect unauthenticated users, and it cannot be triggered through the data-plane (wireless client traffic). Standard network segmentation isolating the management interface from untrusted networks is an effective limiting control.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects full CIA impact on the vulnerable system over the network, but PR:H is the critical limiting factor - exploitation unconditionally requires valid administrative credentials. This significantly narrows the realistic attacker population to those who have already compromised admin accounts, are conducting insider attacks, or are exploiting credential reuse from prior breaches. No EPSS score was provided in the input data and cannot be stated with confidence. No CISA KEV listing exists, and VulnCheck has not reported a public proof-of-concept, indicating no observed widespread exploitation at time of analysis. Despite the high CVSS score, real-world risk is conditional: organizations that expose the VigorAP management interface to untrusted networks (e.g., WAN-facing admin portals) or use weak/shared admin credentials face materially higher risk. For environments with properly segmented management networks and strong credential hygiene, this represents a lower-urgency patch rather than an emergency response.

An attacker who has obtained valid VigorAP administrative credentials - through credential stuffing, phishing, or a prior breach - authenticates to the device's web management interface over the network and submits a crafted time field value to the InquierTime function containing shell metacharacters (e.g., a semicolondelimited OS command). The unsanitized value is passed directly to the system shell, executing the injected command as root, which the attacker can leverage to establish persistence, exfiltrate configuration data including credentials, or pivot to adjacent network segments managed by the access point. No public proof-of-concept has been reported at time of analysis.