cveboard RSS feed

CVE-2026-71913

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2026
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

VigorAP 918R

Vendor
DrayTek Corporation
Product
VigorAP 918R
Platforms
Unknown
Default status
unaffected
VigorAP 918R · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.11UnavailableNone listed

VigorAP 960C

Vendor
DrayTek Corporation
Product
VigorAP 960C
Platforms
Unknown
Default status
unaffected
VigorAP 960C · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.12UnavailableNone listed

VigorAP 1060C

Vendor
DrayTek Corporation
Product
VigorAP 1060C
Platforms
Unknown
Default status
unaffected
VigorAP 1060C · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.12UnavailableNone listed

VigorAP 906

Vendor
DrayTek Corporation
Product
VigorAP 906
Platforms
Unknown
Default status
unaffected
VigorAP 906 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.13UnavailableNone listed

VigorAP 912C

Vendor
DrayTek Corporation
Product
VigorAP 912C
Platforms
Unknown
Default status
unaffected
VigorAP 912C · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.15UnavailableNone listed

VigorAP 903

Vendor
DrayTek Corporation
Product
VigorAP 903
Platforms
Unknown
Default status
unaffected
VigorAP 903 · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
0affectedcustom1.4.22UnavailableNone listed