DrayTek VigorAP CVE-2026-71914

Exploitation requires network reachability to the affected VigorAP's dray_apm UDP service and that the attacker first send a START_SPEED_TEST message, then a crafted UDP message whose content is not properly validated before command execution. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special attack requirement - remote unauthenticated exploitation is possible against affected firmware. The principal limiting factor is exposure of the dray_apm UDP port: devices where that management/speed-test service is firewalled off from untrusted networks or confined to a trusted management VLAN are not reachable for this attack, and only the six listed models below their fixed firmware versions are vulnerable.

This is a genuine high-priority issue rather than an inflated CVSS number: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes remote, unauthenticated, low-complexity exploitation with no user interaction and total impact, and the injection yields root, so the technical impact is maximal. Signals are somewhat mixed on likelihood-of-attack: there is no CISA KEV listing and no confirmed public exploit, and EPSS is not provided in the input, so real-world exploitation frequency cannot be quantified from the data here - the severity is anchored on impact and ease, not on observed activity. VulnCheck reporting plus a vendor advisory add credibility to the finding, and network-exposed management planes on access points are attractive targets, so any operator running an affected VigorAP model - from large campuses down to a mid-sized municipal IT team - should treat patching as urgent, prioritizing devices whose UDP management interface is reachable from untrusted networks. The main residual uncertainty is exposure: risk is highest where the dray_apm UDP port is reachable beyond a trusted management VLAN.

An attacker with network reachability to a VigorAP's dray_apm UDP service sends a START_SPEED_TEST message followed by a crafted UDP payload containing injected shell commands, which the device executes as root without any authentication or user interaction. This grants full control of the access point, enabling traffic interception, pivoting into the internal network, or persistent implantation. No public exploit is identified at time of analysis, but the low complexity and unauthenticated network vector make weaponization straightforward.