Vigorap 906
Monthly
Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis.
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via a crafted restorekey parameter in the upload_settings.cgi endpoint. Six VigorAP hardware models share the vulnerable codebase: 903, 906, 912C, 918R, 960C, and 1060C. Vendor firmware patches are available for all affected models; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands with root privileges. Six CPE-confirmed models across the VigorAP 903, 906, 912C, 918R, 960C, and 1060C series are affected in all firmware versions below their respective patch thresholds. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available and should be applied promptly given the root-level impact.
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authenticated remote attacker to execute arbitrary OS commands with root privileges by submitting crafted input to the InquierTime function's time field via the web management interface. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the time parameter is passed to a system shell without adequate filtering, enabling shell metacharacter injection. No public exploit identified at time of analysis; a vendor-released patch is available across all affected model lines.
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbitrary OS commands with root privileges across six VigorAP models. The vulnerability exists in the mesh_start_speed_test function, where unsanitized meshdevice_index and meshdevice_ip input is passed directly to shell command execution, yielding complete device compromise including full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute arbitrary OS commands with root privileges by submitting crafted input to the setcamset function via the web management interface. Six distinct VigorAP models are confirmed affected across multiple firmware branches, each with a separate patch target version released in August 2026. No public exploit identified at time of analysis, but the network-accessible attack vector and root-level impact make this a high priority for organizations with internet-exposed VigorAP management interfaces.
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the root-level code execution outcome warrants prompt firmware upgrade wherever management interfaces are network-reachable.
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via the ExportSettings function. Insufficient input sanitization of the backupkey, backuptype, and realtime parameters permits shell metacharacter injection before those values are passed to a system command. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates technical impact as total given root-level code execution on network infrastructure devices.
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative credentials to execute arbitrary OS commands as root via the tr069TestInform function. Six models are confirmed affected - VigorAP 903, 906, 912C, 918R, 960C, and 1060C - with vendor-patched firmware available at model-specific versions. No public exploit code has been identified at time of analysis, but the straightforward nature of CWE-78 OS command injection against a root-privileged process means exploitation is trivial for any attacker who has obtained valid admin credentials.
Root-level OS command injection in DrayTek VigorAP wireless access points (models 903, 906, 912C, 918R, 960C, 1060C) lets a remote, unauthenticated attacker run arbitrary commands by sending a crafted UDP message to the dray_apm component after a START_SPEED_TEST request. The flaw stems from missing validation of UDP payload content before it is passed to command execution, and the CVSS 4.0 base score of 9.3 reflects full compromise of confidentiality, integrity, and availability. It was reported by VulnCheck, a vendor patch is available, and no public exploit has been identified at time of analysis.
Command injection in multiple DrayTek VigorAP access point models allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via a crafted restorekey parameter in the upload_settings.cgi endpoint. Six VigorAP hardware models share the vulnerable codebase: 903, 906, 912C, 918R, 960C, and 1060C. Vendor firmware patches are available for all affected models; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Buffer overflow in the apautotest function of DrayTek VigorAP firmware allows an authenticated remote attacker with administrative credentials to cause denial of service or potentially execute arbitrary commands across six affected device models. The root cause is CWE-120 (Classic Buffer Overflow) - the CMD6 field undergoes memory copy operations without length validation, enabling controlled heap or stack corruption. No public exploit code has been identified at time of analysis, the vulnerability is absent from CISA KEV, and a vendor-released patch is confirmed available via DrayTek's August 2026 security advisory.
Buffer overflow in the setLan function of multiple DrayTek VigorAP access point models enables authenticated remote attackers to cause denial of service or execute arbitrary commands on affected devices. Six distinct VigorAP models - 903, 906, 912C, 918R, 960C, and 1060C - are confirmed affected across specific firmware version ranges, all patched by DrayTek in an August 2026 advisory. No public exploit identified at time of analysis, though the vulnerability was independently reported by VulnCheck and the impact class (RCE and DoS) raises operational risk for any organization where VigorAP admin interfaces are reachable from untrusted networks.
Command injection in the apautotest function of multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands with root privileges. Six CPE-confirmed models across the VigorAP 903, 906, 912C, 918R, 960C, and 1060C series are affected in all firmware versions below their respective patch thresholds. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor-released patches are available and should be applied promptly given the root-level impact.
Command injection in DrayTek VigorAP series access points (models 903, 906, 912C, 918R, 960C, and 1060C) allows an authenticated remote attacker to execute arbitrary OS commands with root privileges by submitting crafted input to the InquierTime function's time field via the web management interface. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command) - the time parameter is passed to a system shell without adequate filtering, enabling shell metacharacter injection. No public exploit identified at time of analysis; a vendor-released patch is available across all affected model lines.
Command injection in DrayTek VigorAP mesh networking firmware allows authenticated remote administrators to execute arbitrary OS commands with root privileges across six VigorAP models. The vulnerability exists in the mesh_start_speed_test function, where unsanitized meshdevice_index and meshdevice_ip input is passed directly to shell command execution, yielding complete device compromise including full confidentiality, integrity, and availability impact. Vendor-released patches are available for all affected models; no public exploit code or CISA KEV listing has been identified at time of analysis.
Command injection in DrayTek VigorAP series wireless access points allows authenticated remote administrators to execute arbitrary OS commands with root privileges by submitting crafted input to the setcamset function via the web management interface. Six distinct VigorAP models are confirmed affected across multiple firmware branches, each with a separate patch target version released in August 2026. No public exploit identified at time of analysis, but the network-accessible attack vector and root-level impact make this a high priority for organizations with internet-exposed VigorAP management interfaces.
Command injection in multiple DrayTek VigorAP access point models allows a remote attacker holding valid administrative credentials to execute arbitrary OS commands as root by submitting malicious input to the setLan function's lanIp or lanNetmask parameters. Six models spanning several firmware lines are confirmed affected, with vendor patches now available for all of them per the August 2026 DrayTek security advisory. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the root-level code execution outcome warrants prompt firmware upgrade wherever management interfaces are network-reachable.
Command injection in DrayTek VigorAP series access points allows an authenticated remote attacker with administrative credentials to execute arbitrary OS commands as root via the ExportSettings function. Insufficient input sanitization of the backupkey, backuptype, and realtime parameters permits shell metacharacter injection before those values are passed to a system command. No public exploit or CISA KEV listing exists at time of analysis, but SSVC rates technical impact as total given root-level code execution on network infrastructure devices.
Command injection in multiple DrayTek VigorAP firmware models allows authenticated remote attackers with administrative credentials to execute arbitrary OS commands as root via the tr069TestInform function. Six models are confirmed affected - VigorAP 903, 906, 912C, 918R, 960C, and 1060C - with vendor-patched firmware available at model-specific versions. No public exploit code has been identified at time of analysis, but the straightforward nature of CWE-78 OS command injection against a root-privileged process means exploitation is trivial for any attacker who has obtained valid admin credentials.