Description (CNA)
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| DrayTek Corporation / VigorAP 918R | affected 0 before 1.4.11 |
| DrayTek Corporation / VigorAP 960C | affected 0 before 1.4.12 |
| DrayTek Corporation / VigorAP 1060C | affected 0 before 1.4.12 |
| DrayTek Corporation / VigorAP 906 | affected 0 before 1.4.13 |
| DrayTek Corporation / VigorAP 912C | affected 0 before 1.4.15 |
| DrayTek Corporation / VigorAP 903 | affected 0 before 1.4.22 |
CWE
CWE-78
References
- https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
- https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-upload-settings-cgi
ADP enrichment
No English description supplied.
No references supplied.