Skip to content
OpenAdvisories
High NCSC-2026-0327 11 CVEs

Kwetsbaarheden verholpen in DrayTek VigorAP

Published Aug 26, 2026 · Updated Aug 26, 2026 · nl

Vendor: DrayTek Product: Vigor Product: Vigorap 1000C Firmware Product: VigorAP 1060c Firmware Product: VigorAP 700 Firmware Product: VigorAP 800 Firmware Product: VigorAP 802 Firmware Product: VigorAP 900 Firmware Product: VigorAP 902 Firmware Product: Vigorap 903 Firmware Product: VigorAP 910C Firmware Product: VigorAP 912C Firmware Product: VigorAP 918R Firmware Product: VigorAP 920R Firmware Product: Vigorap 960C Firmware

Summary

DrayTek heeft meerdere kwetsbaarheden verholpen in de VigorAP productlijn.

Details

Interpretaties
De kwetsbaarheden bevinden zich in verschillende functies en componenten van de DrayTek VigorAP apparaten, waaronder tr069TestInform, ExportSettings, setLan, setcamset, mesh_start_speed_test, InquierTime, apautotest, upload_settings.cgi en dray_apm. Deze kwetsbaarheden maken het mogelijk voor aanvallers met geldige authenticatie om via onvoldoende inputvalidatie en filtering willekeurige commando's uit te voeren met root-privileges. Daarnaast is er sprake van buffer overflow kwetsbaarheden in de setLan en apautotest functies, waarbij door het versturen van speciaal vervaardigde input een denial of service kan worden veroorzaakt of willekeurige code kan worden uitgevoerd. Exploitatie van deze kwetsbaarheden kan leiden tot volledige systeemcompromittering binnen de context van de root gebruiker. De kwetsbaarheden zijn specifiek van toepassing op meerdere modellen binnen de DrayTek VigorAP productlijn.

Oplossingen
DrayTek heeft updates uitgebracht om de kwetsbaarheden in de VigorAP apparaten te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 11

  • Critical 9.8
    CVE-2026-71914

    DrayTek VigorAP Multiple Models Pre-Authentication OS Command Injection via dray_apm

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after START_SPEED_TEST before command execution. A remote attacker can trigger t…

    DrayTek VigorAP 912C VigorAP 960C VigorAP 906 Network devices
  • High 7.2
    CVE-2026-71904

    DrayTek VigorAP Multiple Models OS Command Injection via tr069TestInform

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event_code field is concatenated into a system command. A remot…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71905

    DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can t…

    DrayTek VigorAP 912C VigorAP 960C VigorAP 906 Network devices
  • High 7.2
    CVE-2026-71906

    DrayTek VigorAP Multiple Models OS Command Injection via setLan

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerabil…

    DrayTek VigorAP 912C VigorAP 960C VigorAP 906 Network devices
  • High 7.2
    CVE-2026-71907

    DrayTek VigorAP Multiple Models OS Command Injection via setcamset

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71908

    DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attac…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71909

    DrayTek VigorAP Multiple Models OS Command Injection via InquierTime

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via craft…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71910

    DrayTek VigorAP Multiple Models OS Command Injection via apautotest

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulner…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71911

    DrayTek VigorAP Multiple Models Buffer Overflow via setLan

    Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the lanVlanId0, lanIp, and lanNetmask fields. A remote attacker can tr…

    DrayTek VigorAP 903 VigorAP 918R VigorAP 1060C Network devices
  • High 7.2
    CVE-2026-71912

    DrayTek VigorAP Multiple Models Buffer Overflow via apautotest

    Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability v…

    DrayTek VigorAP 912C VigorAP 960C VigorAP 906 Network devices
  • High 7.2
    CVE-2026-71913

    DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi

    Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigg…

    DrayTek VigorAP 912C VigorAP 960C VigorAP 906 Network devices

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-buffer-overflow-via-apautotest
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-buffer-overflow-via-setlan
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-apautotest
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-exportsettings
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-inquiertime
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-mesh-start-speed-test
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setcamset
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-setlan
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-tr069testinform
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-upload-settings-cgi
  • Reference
    https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-pre-authentication-os-command-injection-via-dray-apm