This vulnerability involves a classic buffer overflow in multiple DrayTek VigorAP models, specifically in the apautotest function. The root cause is the lack of input size validation when copying data related to the CMD6 field. Exploitation requires authenticated access with administrative privileges to the device's web interface, allowing a remote attacker to trigger the overflow via crafted input. The impact includes denial of service and the possibility of arbitrary command execution.

Successful exploitation can lead to denial of service conditions or arbitrary command execution on affected devices. However, exploitation requires valid administrative credentials, limiting the attack surface to authorized users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should monitor DrayTek's advisories for updates. In the meantime, restrict administrative access to trusted personnel and networks to reduce risk.