DrayTek VigorAP CVE-2026-71911

Exploitation requires valid administrative credentials for the device's web management interface - CVSS PR:H confirms this. The attack is delivered over the network (AV:N), requiring IP reachability to the management interface (typically TCP 80 or 443). No additional special configuration beyond standard deployment is required once admin access is obtained. The primary limiting factor is the admin credential requirement: without valid credentials, the vulnerability cannot be reached. Additional limiting factors include: network segmentation isolating the management interface from untrusted hosts prevents remote exploitation entirely; and the vulnerability is in the LAN configuration handler (setLan), which is a standard feature of the device - no non-default feature enablement is required beyond having admin access.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, score 8.6) reflects network accessibility with low attack complexity but a critical prerequisite: PR:H (high privileges, i.e., valid admin credentials). This materially reduces real-world risk compared to unauthenticated network exploits - an attacker must first compromise or possess device administrator credentials before reaching the vulnerable function. No CISA KEV listing exists, indicating no confirmed in-the-wild exploitation at time of analysis. No POC is referenced in available intelligence. EPSS data is not provided in the input. The SC:N/SI:N/SA:N metrics confirm no scope change beyond the device itself - lateral movement to adjacent systems is not directly enabled by this vulnerability alone. Real-world prioritization: organizations with VigorAP devices whose management interfaces are exposed to the internet or untrusted VLANs should treat this as high priority; those with properly segmented management networks and strong credential hygiene face substantially lower operational risk.

An attacker who has obtained valid administrative credentials for a VigorAP device - through credential reuse, phishing, brute-force against an internet-exposed management portal, or insider access - authenticates to the web management interface and submits a crafted LAN configuration request containing an oversized value in the lanVlanId0, lanIp, or lanNetmask parameter. The oversized input overflows the destination buffer in the setLan function, corrupting adjacent memory and either crashing the device (denial of service) or redirecting code execution to attacker-controlled instructions, potentially yielding a root shell on the access point.