DrayTek VigorAP CVE-2026-71913

Exploitation requires valid administrative credentials for the DrayTek VigorAP web management interface, confirmed by both the CVE description and the CVSS PR:H metric - unauthenticated exploitation is not possible. The vulnerable endpoint (upload_settings.cgi) must be reachable by the attacker, either over the local network segment or remotely if the device's HTTP/HTTPS management port is exposed to the internet. The web management interface is enabled by default on VigorAP devices, so no non-default configuration is required beyond the attacker possessing admin credentials. Limiting factors: the admin authentication prerequisite is the primary barrier to exploitation; strong unique administrative passwords and network-level restriction of management interface access (firewall rules, VLAN segmentation) together eliminate or greatly reduce realistic exploitability even on unpatched firmware.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) reflects network-reachable exploitation with no complexity or attack preconditions beyond valid administrative credentials (PR:H). That credential prerequisite is the decisive risk-limiting factor: this is not an unauthenticated pre-auth exploit, and the effective attack surface narrows considerably when strong, unique admin passwords are enforced and management interfaces are not internet-exposed. No EPSS score was supplied in the input data; absence of a KEV listing indicates no confirmed mass or widespread exploitation at time of analysis, and no public POC has been referenced. Despite the high CVSS score, real-world priority should be calibrated accordingly: organizations with internet-facing VigorAP management interfaces or weak/default credentials face meaningfully higher risk and should treat patching as urgent. Those with management access restricted to internal VLANs and strong credentials have a reduced but non-zero risk profile - patch cadence should still be prompt given complete root compromise is the outcome upon successful exploitation.

An attacker who has acquired valid VigorAP administrator credentials - through credential stuffing against exposed management interfaces, default password exploitation, or phishing - authenticates to the web management UI and submits a crafted HTTP POST request to upload_settings.cgi, embedding shell metacharacters in the restorekey field (e.g., restorekey=foo;id>/tmp/pwned). The embedded Linux shell processes the concatenated command without sanitization, executing the injected payload as root. From this point the attacker has full control of the access point, enabling persistent backdoor installation, traffic interception, or lateral movement into the connected LAN. No public POC has been identified, but OS command injection via unsanitized CGI parameters is a well-documented, low-sophistication exploitation class requiring no specialized tooling.