CVE-2026-71913: DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi
Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to reach the device's web management interface and possess valid administrative credentials. The issue can then be triggered remotely through crafted input supplied to the upload_settings.cgi interface.
What level of access could exploitation provide?
Successful exploitation allows execution of arbitrary operating-system commands with root privileges on the affected device. This can result in complete compromise of the device's confidentiality, integrity, and availability.
Which input is involved in the vulnerable request?
The vulnerable input is the restorekey field handled by upload_settings.cgi. Insufficient filtering allows this value to be concatenated into a shell command.