This vulnerability in DrayTek VigorAP 918R involves improper neutralization of special elements used in OS commands within the mesh_start_speed_test function. Specifically, the meshdevice_index and meshdevice_ip fields are not properly sanitized before being used in command execution, allowing a remote attacker with administrative access to execute arbitrary OS commands with root privileges. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high privileges required. No patch or vendor advisory is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary commands on the device with root privileges, potentially leading to full system compromise. This could affect device integrity, confidentiality, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for unauthorized access attempts. No official patch or workaround has been published by DrayTek Corporation as of now.