This vulnerability affects multiple DrayTek VigorAP models, including the VigorAP 918R. The root cause is improper neutralization of special elements in the selectSlaves input field within the setcamset function, allowing command injection. Exploitation requires authenticated access with administrative privileges to the device's web interface. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently provided, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary OS commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Since exploitation requires valid admin credentials, enforcing strong authentication and access controls is critical.