CVE-2026-71908: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorAP 918R

This vulnerability arises from improper neutralization of special elements in input fields meshdevice_index and meshdevice_ip within the mesh_start_speed_test function of DrayTek VigorAP devices. Because these inputs are not properly sanitized before being used in OS command execution, an attacker who has administrative access to the device's web interface can craft input to execute arbitrary OS commands with root-level privileges. This could lead to full control over the affected device.

Successful exploitation allows an attacker with administrative web interface credentials to execute arbitrary commands on the device with root privileges. This can compromise the device's integrity and potentially the network it serves. The vulnerability requires high privileges (administrative credentials) and does not involve user interaction beyond authenticated access.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device's management interface.