CVE-2026-71911: DrayTek VigorAP Multiple Models Buffer Overflow via setLan
Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must have valid administrative credentials for the device's web management interface. The attack does not require user interaction.
What is the likely impact if exploitation succeeds?
Crafted input to the affected setLan fields can cause a denial of service and may allow arbitrary command execution. The reported impact includes compromise of confidentiality, integrity, and availability.
Which inputs are involved in the vulnerable operation?
The affected memory copy operations involve the lanVlanId0, lanIp, and lanNetmask fields handled by the setLan function.