This vulnerability in DrayTek VigorAP 918R devices involves improper neutralization of special elements in the apautotest function, specifically in the CMD0, CMD3, and CMD6 fields. Due to insufficient input validation, a remote attacker who has valid administrative access to the device's web management interface can inject and execute arbitrary OS commands with root-level privileges. The vulnerability is classified as an OS command injection and has a CVSS 4.0 base score of 8.6, indicating high severity. No known exploits in the wild have been reported, and no patch or remediation level has been disclosed by the vendor as of the publication date.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary commands on the device with root privileges, potentially leading to full control over the affected device. This could compromise device integrity, confidentiality, and availability. Since exploitation requires valid admin credentials, the risk is limited to attackers who have already gained administrative access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for unauthorized access attempts. No vendor-provided temporary or official fixes are currently documented.