This vulnerability affects multiple DrayTek VigorAP models, including the VigorAP 918R. The root cause is improper neutralization of special elements in the restorekey parameter of the upload_settings.cgi interface, which is concatenated directly into a shell command without adequate sanitization. Exploitation requires authenticated access to the device's web management interface, allowing a remote attacker to execute arbitrary OS commands with root-level privileges. The CVSS 4.0 base score is 8.6, indicating high severity. No official patch or remediation guidance is currently available from the vendor, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative credentials to execute arbitrary commands on the device with root privileges, potentially leading to full device compromise. This could affect the confidentiality, integrity, and availability of the device and its network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for unauthorized access attempts. Since exploitation requires valid credentials, enforcing strong authentication and access controls is critical.