Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.
A buffer overflow vulnerability exists in the setLan function of DrayTek VigorAP 918R devices due to missing length checks during memory copy operations on certain LAN configuration fields. Exploitation requires valid administrative credentials and can lead to denial of service or arbitrary command execution.
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71908 is a high-severity OS command injection vulnerability affecting multiple DrayTek VigorAP models, including the VigorAP 918R. The flaw exists in the mesh_start_speed_test function due to insufficient sanitization of the meshdevice_index and meshdevice_ip parameters. A remote attacker with valid administrative credentials to the device's web management interface can exploit this vulnerability to execute arbitrary commands with root privileges.
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
CVE-2026-71906 is a high-severity OS command injection vulnerability in multiple DrayTek VigorAP models, including the VigorAP 918R. The flaw exists in the setLan function due to insufficient validation of the lanIp and lanNetmask fields before executing system commands. An attacker with valid administrative credentials on the device's web management interface can exploit this to execute arbitrary commands with root privileges.
CVE-2026-71905 is a command injection vulnerability in DrayTek VigorAP 918R devices. It affects the ExportSettings function due to insufficient filtering of certain input fields. An attacker with valid administrative credentials can execute arbitrary commands with root privileges on the device. The vulnerability has a high severity score of 8.6 and requires no user interaction but does require high privileges.
Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that "300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it." This vulnerability only affects products that are no longer supported by the maintainer.
An uninitialized variable in the HTTP CGI request arguments processing component of Vigor Routers running DrayOS may allow an attacker the ability to perform RCE on the appliance through memory corruption.
Multiple DrayTek Vigor routers (Vigor3900, Vigor2960, and Vigor300B) have an OS command injection vulnerability in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint. This flaw allows remote attackers to execute arbitrary commands by injecting shell metacharacters in a filename when the content type text/x-python-script is used. The vulnerability is known to be exploited in the wild.
Draytek VigorConnect has a path traversal vulnerability in the DownloadFileServlet endpoint that allows unauthenticated attackers to download arbitrary files from the underlying operating system with root privileges. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Draytek VigorConnect has a path traversal vulnerability in its WebServlet file download functionality. This flaw allows an unauthenticated attacker to download arbitrary files from the underlying operating system with root privileges. The vulnerability has been exploited in the wild, indicating active attacks. No specific affected versions or patch information are provided.
Multiple DrayTek Vigor routers, including models Vigor3900, Vigor2960, and Vigor300B, have a vulnerability in their web management interface that allows remote code execution. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
