EUVD-2026-64973
GHSA-q93r-mff6-h5vp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated UDP message triggers root command execution with no user interaction (AV:N/AC:L/PR:N/UI:N), yielding full compromise; scope unchanged as execution stays on the device OS.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger this vulnerability via a crafted message to execute arbitrary commands with root privileges.
AnalysisAI
Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the affected VigorAP's dray_apm UDP service and that the attacker first send a START_SPEED_TEST message, then a crafted UDP message whose content is not properly validated before command execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with no user interaction and total impact, and the injection yields root, so the technical impact is maximal. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patched firmware for each model to the exact fixed version or later: VigorAP 903 to 1.4.22, VigorAP 906 to 1.4.13, VigorAP 912C to 1.4.15, VigorAP 918R to 1.4.11, VigorAP 960C to 1.4.12, and VigorAP 1060C to 1.4.12, per the DrayTek advisory (https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all DrayTek VigorAP models 903, 906, 912C, 918R, 960C, and 1060C in your environment and assess their network accessibility. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Vigorap 918R
View allCommand injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker ho
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authe
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbi
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative cr
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administr
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with admi
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote atta
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today