CVE-2026-71914: DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm
Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker can exploit it without authentication or user interaction by sending a crafted UDP message to the vulnerable dray_apm component.
What level of access could exploitation provide?
Successful exploitation allows arbitrary command execution with root privileges, which can result in full compromise of the affected VigorAP device.
What network traffic is associated with exploitation attempts?
The vulnerable processing occurs when dray_apm handles UDP message content after a START_SPEED_TEST message. Monitoring for unexpected or malformed UDP messages involving this operation may help identify attempts.