CVE-2026-71905: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorAP 918R

This vulnerability in DrayTek VigorAP 918R arises from improper neutralization of special elements in the ExportSettings function. Specifically, the backupkey, backuptype, and realtime fields are not adequately sanitized before being used in OS command execution. This flaw allows a remote attacker who has valid administrative credentials on the device's web management interface to execute arbitrary OS commands with root privileges, potentially compromising the device fully. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required but with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker with administrative access to execute arbitrary commands as root on the affected device, leading to full compromise of the device. This could result in unauthorized control, data theft, or disruption of device functionality. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users or those who have obtained such credentials.

No official patch or remediation level has been published by the vendor as of the current information. Administrators should monitor vendor advisories for updates. Since exploitation requires administrative credentials, enforcing strong authentication, limiting administrative access, and monitoring for suspicious administrative activity are recommended interim measures. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.