CVE-2026-71913: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DrayTek Corporation VigorAP 918R

CVE-2026-71913 is an OS command injection vulnerability affecting DrayTek VigorAP 918R and other models. The vulnerability exists in the upload_settings.cgi interface where the restorekey parameter is concatenated into a shell command without proper sanitization. This allows a remote attacker who has valid administrative credentials on the device's web management interface to execute arbitrary commands with root privileges. The CVSS 4.0 base score is 8.6, reflecting high severity with network attack vector, low attack complexity, and no user interaction required. No vendor advisory or patch information is currently provided.

Successful exploitation allows an authenticated remote attacker to execute arbitrary commands with root privileges on the affected device. This can lead to full compromise of the device, including unauthorized control, data manipulation, or disruption of network services. The vulnerability requires valid administrative credentials, limiting exploitation to insiders or attackers who have obtained such credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted personnel only and consider additional network-level protections to limit access to the device's management interface.