Kwetsbaarheden verholpen in DrayTek VigorAP

The Nationaal Cyber Security Centrum has published an advisory (NCSC-2026-0327) addressing multiple security vulnerabilities in the DrayTek VigorAP product line, including 11 CVEs (CVE-2026-71904 through CVE-2026-71914). The vulnerabilities include command injection (CWE-78) and buffer overflow (CWE-120) types. The advisory covers DrayTek VigorAP 1060c firmware and related products, but does not specify exact affected firmware versions or patch status. No CVSS scores or exploit details are provided in the input data.

The vulnerabilities potentially allow attackers to execute arbitrary commands or cause memory corruption on affected DrayTek VigorAP devices. This could lead to unauthorized control or denial of service. However, no known exploits in the wild have been reported, and the exact impact depends on the specific vulnerabilities and device configurations.

Patch status is not yet confirmed — check the vendor advisory (NCSC-2026-0327) for current remediation guidance. Since the advisory indicates that vulnerabilities have been addressed, applying official firmware updates from DrayTek when available is recommended. No vendor advisory content explicitly states 'no action required' or 'already mitigated,' so monitoring the vendor's official channels for patches is advised.