CVE-2026-71906

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setlan

Configurations

No configuration.

History

13 Oct 2026, 09:10

Type	Values Removed	Values Added
Summary		(es) Múltiples modelos DrayTek VigorAP contienen una vulnerabilidad de inyección de comandos en la función setLan. La vulnerabilidad es causada por una validación insuficiente de los campos lanIp y lanNetmask antes de la ejecución de comandos. Un atacante remoto puede desencadenar esta vulnerabilidad a través de una entrada manipulada para ejecutar comandos arbitrarios con privilegios de root. La explotación requiere credenciales administrativas válidas para la interfaz de gestión web del dispositivo.

Information

Published : 2026-08-24 18:17

Updated : 2026-10-13 09:10

NVD link : CVE-2026-71906

Mitre link : CVE-2026-71906

CVE.ORG link : CVE-2026-71906

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-71906", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71906", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T18:27:33.248090Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "DrayTek Corporation", "product": "VigorAP 918R", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.11", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 960C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 1060C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 906", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.13", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 912C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 903", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.22", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-24T18:17:02.067", "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setlan", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface."}, {"lang": "es", "value": "M\u00faltiples modelos DrayTek VigorAP contienen una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n setLan. La vulnerabilidad es causada por una validaci\u00f3n insuficiente de los campos lanIp y lanNetmask antes de la ejecuci\u00f3n de comandos. Un atacante remoto puede desencadenar esta vulnerabilidad a trav\u00e9s de una entrada manipulada para ejecutar comandos arbitrarios con privilegios de root. La explotaci\u00f3n requiere credenciales administrativas v\u00e1lidas para la interfaz de gesti\u00f3n web del dispositivo."}], "lastModified": "2026-10-13T09:10:00.323", "sourceIdentifier": "disclosure@vulncheck.com"}