DrayTek VigorAP CVE-2026-71910

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - explicitly stated in the CVE description and confirmed by the PR:H metric in the CVSS 4.0 vector. The apautotest function must be reachable via the web management interface, which is network-accessible (AV:N). No special non-default configuration or feature toggle is required beyond possessing admin-level access to the web UI. Key limiting factors: the attacker must first obtain administrator credentials (PR:H eliminates unauthenticated exploitation paths); exploitation is further constrained if the management interface is isolated to a dedicated management VLAN or restricted by firewall ACL. Devices with WAN-side remote management enabled and weak or default credentials present substantially higher real-world risk than those with management-plane isolation enforced.

The CVSS 4.0 score of 8.6 is driven by full CIA impact (VC:H/VI:H/VA:H) on the vulnerable device, which accurately reflects root-level arbitrary command execution. The PR:H metric is the critical constraining factor: an attacker must first hold valid administrative credentials, meaningfully narrowing the realistic threat pool compared to unauthenticated network-exploitable flaws. No EPSS data was supplied, so exploitation probability cannot be independently quantified. The CVE carries no CISA KEV listing and no public exploit code has been identified, placing current exploitation risk in the lower tier despite the high-impact score. The practical risk profile is therefore credential-dependent: the primary threat scenarios involve compromised or weak admin passwords, insider misuse, or management interfaces exposed to untrusted networks - a common configuration gap in SMB deployments where even a small IT team managing dozens of VigorAP units may not enforce strong credential hygiene or management-plane isolation. The administrative credential barrier is real but should not be treated as a permanent mitigating factor, as credential theft is a routine precursor step in many attack chains.

An attacker who has obtained valid VigorAP administrative credentials - through credential stuffing, phishing, or reuse from a prior breach - authenticates to the web management interface over the network and submits a crafted HTTP request to the apautotest endpoint with OS command sequences embedded in the CMD0, CMD3, or CMD6 parameters. The injected commands pass unsanitized to the device shell and execute with root privileges, enabling the attacker to establish persistence, exfiltrate configuration and credentials, pivot to adjacent network segments, or brick the device. No public proof-of-concept code has been identified, but CWE-78 injection in web management interfaces of this class is well-understood and straightforward for a capable attacker.