This vulnerability arises from improper neutralization of special elements used in OS commands within the ExportSettings function of DrayTek VigorAP devices. Specifically, the backupkey, backuptype, and realtime fields are not adequately sanitized before being passed to command execution, allowing a remote attacker with administrative access to inject and execute arbitrary OS commands with root-level privileges. No official remediation or patch information is currently available, and exploitation requires valid admin credentials, limiting the attack surface.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary commands with root privileges on the affected device, potentially leading to full system compromise. However, the requirement for valid admin credentials reduces the likelihood of remote exploitation by unauthorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and consider additional network-level protections to limit access to the device's management interface.