CVE-2026-71904: DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the eventcode field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this vulnerability?
The attacker must have valid administrative credentials for the VigorAP web management interface. No user interaction is required once the attacker can submit crafted input to the vulnerable function.
What level of access could successful exploitation provide?
Successful exploitation can execute arbitrary operating-system commands with root privileges on the affected device. This can fully compromise the device's confidentiality, integrity, and availability.
Which input is involved in the command injection?
The vulnerable tr069TestInform function concatenates the event_code field into a system command without adequately filtering dangerous characters. Crafted event_code input can therefore be used to inject commands.