DrayTek VigorAP EUVD-2026-64964

Exploitation requires valid administrative credentials for the VigorAP web management interface - this is explicitly stated in the CVE description and reflected in the CVSS 4.0 PR:H metric. Without admin-level authentication, the ExportSettings endpoint is inaccessible to an attacker. The web management interface must be reachable over the network; if restricted to a management VLAN or protected by an ACL, the network attack vector is partially mitigated. The vulnerability is present across all firmware versions below the per-model fix thresholds listed in the affected versions data. No non-default configuration is required: the ExportSettings function is a standard feature of the device's management interface. The key limiting factors are the admin credential prerequisite (breaking automated mass exploitation) and the fact that all six affected models require separate targeting.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) scores 8.6, reflecting network-accessible exploitation without special conditions but requiring high privileges (valid admin credentials). EPSS stands at 3.05%, which maps to the 87th percentile - meaning this vulnerability is being watched by the threat intelligence community more than most, despite a low absolute exploitation probability. SSVC concurs with an exploitation status of none and automatable=no, recognizing that credential acquisition is a prerequisite that breaks automated mass-scanning. Technical impact is rated total, consistent with root-level shell access on a network device. The combination of admin-credential requirement and SSVC automatable=no meaningfully reduces real-world mass-exploitation risk, though targeted attacks against environments where default or reused admin passwords are common remain plausible. No KEV listing and no confirmed POC lower urgency relative to the raw CVSS score. DrayTek devices are popular in SMB deployments where dedicated credential hygiene practices are often less rigorous, which elevates realistic risk in those segments.

An attacker who has obtained administrative credentials for a VigorAP device - through credential stuffing, default password use, or a prior compromise - logs into the web management interface and submits a crafted POST request to the ExportSettings function with a shell metacharacter payload embedded in the backupkey, backuptype, or realtime parameter. The injected command executes as root on the access point's embedded OS, granting full device control. No public exploit code has been identified at time of analysis, but the attack is straightforward for anyone with web-application exploitation experience and valid credentials.