Description
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| DrayTek | VigorAP 918R | < 1.4.11 | 1.4.11 |
| DrayTek | VigorAP 960C | < 1.4.12 | 1.4.12 |
| DrayTek | VigorAP 1060C | < 1.4.12 | 1.4.12 |
| DrayTek | VigorAP 906 | < 1.4.13 | 1.4.13 |
| DrayTek | VigorAP 912C | < 1.4.15 | 1.4.15 |
| DrayTek | VigorAP 903 | < 1.4.22 | 1.4.22 |
Advisories 2
- NCSC-2026-0327 Kwetsbaarheden verholpen in DrayTek VigorAP NCSC-NL (Netherlands) · Aug 26, 2026
- WID-SEC-2026-2990 DrayTek VigorAP: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Aug 24, 2026