This vulnerability in DrayTek VigorAP 918R arises from improper neutralization of special elements in the setLan function, specifically in the lanIp and lanNetmask input fields. Because these inputs are not properly validated before being used in OS command execution, a remote attacker who has valid admin credentials can inject arbitrary commands. The vulnerability requires authenticated access to the device's web management interface and allows command execution with root privileges, posing a significant risk to device integrity and network security.

Successful exploitation allows an attacker with administrative access to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized configuration changes, data theft, or pivoting to other network assets. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users or those who have obtained such credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit access to the device's management interface.