This vulnerability affects multiple DrayTek VigorAP models, specifically the VigorAP 918R. The root cause is improper neutralization of special elements in the time field before command execution in the InquierTime function. An attacker who has valid admin credentials to the device's web management interface can exploit this flaw to execute arbitrary OS commands with root privileges. The CVSS 4.0 base score is 8.6, indicating high severity. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with administrative access to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This can affect the confidentiality, integrity, and availability of the device and its managed network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and monitor for suspicious activity on the device management interface. No official fix or temporary workaround has been published.