DrayTek VigorAP CVE-2026-71912

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface - confirmed by PR:H in the CVSS 4.0 vector; unauthenticated exploitation is not possible. The vulnerable code path (apautotest function, CMD6 field) must be reachable via the web management interface, which must be network-accessible to the attacker. Limiting factors: admin authentication is a hard prerequisite; restricting web management access to a management-only VLAN or IP allowlist via firewall ACLs fully neutralizes the network attack vector; only the six specific VigorAP models running firmware below the patched versions are vulnerable. No non-default configuration or special feature enablement beyond standard web management access is described as required.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, scoring 8.6) is internally consistent with the description: the vulnerability is network-reachable and low-complexity to trigger, but PR:H is the dominant risk modifier, confirming that valid administrative credentials are a hard prerequisite for exploitation. This substantially narrows the realistic attacker population to insiders, actors who have already compromised admin credentials via phishing or credential reuse, or those exploiting the vulnerability as a post-authentication lateral movement step. No EPSS score was provided, leaving probabilistic exploitation frequency unquantified. The vulnerability is not in CISA KEV and no public exploit code has been identified, making opportunistic mass exploitation unlikely at this time. Real-world risk is moderate-to-high for organizations with weak management interface access controls or poor admin credential hygiene, and substantially lower for those who restrict VigorAP web management to dedicated management networks. The high C/I/A impact metrics reflect full device compromise potential once the authentication bar is cleared.

An attacker who has obtained valid VigorAP administrative credentials - through phishing, credential reuse, or insider access - authenticates to the device's web management interface and submits a crafted HTTP request to the apautotest endpoint with an oversized CMD6 field. The firmware copies the input into a fixed-size buffer without length validation, overflowing it and corrupting adjacent memory. Depending on firmware memory layout and the presence or absence of stack canaries or ASLR, the outcome is either a device crash requiring manual reboot (denial of service) or redirection of execution to attacker-controlled code.