EUVD-2026-64971
GHSA-79qv-wp74-hqv7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web interface but PR:H reflects mandatory admin authentication; S:U because overflow impact is confined to the device itself with no scope change.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
AnalysisAI
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - confirmed by PR:H in the CVSS 4.0 vector; unauthenticated exploitation is not possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, scoring 8.6) is internally consistent with the description: the vulnerability is network-reachable and low-complexity to trigger, but PR:H is the dominant risk modifier, confirming that valid administrative credentials are a hard prerequisite for exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade affected devices to their respective patched firmware versions immediately: VigorAP 903 to 1.4.22 or later, VigorAP 906 to 1.4.13 or later, VigorAP 912C to 1.4.15 or later, VigorAP 918R to 1.4.11 or later, VigorAP 960C to 1.4.12 or later, and VigorAP 1060C to 1.4.12 or later, as documented in the DrayTek advisory at https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your inventory to identify all DrayTek VigorAP devices across the six affected models and confirm current firmware versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vigorap 918R
View allRoot-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) let
Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker ho
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authe
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbi
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative cr
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administr
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote atta
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today