CVE-2026-71905: DrayTek VigorAP RCE Vulnerability

CVE-2026-71905 Overview

CVE-2026-71905 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the ExportSettings function of the web management interface. Insufficient input filtering on the backupkey, backuptype, and realtime fields allows attackers to inject shell metacharacters into command execution routines. A remote authenticated attacker with administrative credentials can execute arbitrary commands with root privileges on the affected device.

Critical Impact
Successful exploitation grants full root-level control of the access point, enabling network pivoting, traffic interception, and persistent implant deployment across managed wireless infrastructure.

Affected Products

Multiple DrayTek VigorAP series wireless access point models
Firmware versions listed in the DrayTek August 2026 security advisory
Devices exposing the web management interface to reachable networks

Discovery Timeline

2026-08-24 - CVE-2026-71905 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71905

Vulnerability Analysis

The vulnerability affects the ExportSettings function used to generate configuration backups from the VigorAP web management interface. The handler accepts user-supplied values for backupkey, backuptype, and realtime parameters. These values flow into an operating system command invocation without proper sanitization or argument separation.

An authenticated administrator can inject shell metacharacters such as semicolons, backticks, or pipes into any of the three parameters. The injected payload executes in the context of the web server process, which runs as root on VigorAP firmware. This yields full device compromise, including access to Wi-Fi keys, VLAN configuration, and radius shared secrets.

The issue is classified as Improper Neutralization of Special Elements used in an OS Command [CWE-78]. Exploitation requires network reachability to the management interface and valid administrative credentials.

Root Cause

The root cause is missing input validation before the ExportSettings function passes parameters to a shell command. The firmware constructs command strings by concatenating user-controlled fields rather than using safe argument arrays or an allowlist of permitted characters.

Attack Vector

An attacker authenticates to the web management interface using valid administrative credentials. The attacker then submits a crafted request to the settings export endpoint containing shell metacharacters in the backupkey, backuptype, or realtime fields. The firmware invokes a shell command incorporating the attacker payload, executing arbitrary commands as root.

Credential compromise routes include phishing of network administrators, credential stuffing against exposed management portals, and default or reused passwords on unmanaged devices. Consult the DrayTek Security Advisory and the VulnCheck Advisory on DrayTek for parameter-level technical details.

Detection Methods for CVE-2026-71905

Indicators of Compromise

HTTP POST requests to the VigorAP settings export endpoint containing shell metacharacters such as ;, |, `, or $( in the backupkey, backuptype, or realtime fields
Unexpected outbound connections originating from VigorAP devices to external hosts
New or modified files in firmware writable paths and unexpected processes spawned by the web server

Detection Strategies

Inspect web application firewall and reverse proxy logs for anomalous parameter content on management interface requests
Correlate authentication events on VigorAP devices with subsequent outbound network activity from the same device
Baseline normal ExportSettings request patterns and alert on deviations in parameter length, encoding, or character class

Monitoring Recommendations

Forward VigorAP syslog and administrative audit events to a centralized SIEM for retention and analysis
Monitor for administrative logins from unexpected source addresses or outside business hours
Track firmware version drift across the fleet to identify unpatched devices

How to Mitigate CVE-2026-71905

Immediate Actions Required

Apply the firmware updates listed in the DrayTek August 2026 security advisory to all VigorAP devices
Restrict access to the web management interface to a dedicated management VLAN or trusted administrative subnet
Rotate administrative credentials and enforce unique, high-entropy passwords across all VigorAP devices
Audit administrative accounts and remove unused or shared credentials

Patch Information

DrayTek published fixed firmware in the August 2026 VigorAP security advisory covering the affected models. Administrators should review the DrayTek Security Advisory to identify the fixed version for each model and deploy the update through the vendor upgrade process.

Workarounds

Disable remote administration on the WAN interface and permit management only from the local LAN
Place VigorAP management interfaces behind a VPN or jump host requiring multi-factor authentication
Apply access control lists on upstream switches to filter traffic destined for the management interface

bash

# Configuration example: restrict management access at an upstream firewall
# Permit management traffic only from the administrative subnet
allow tcp from 10.10.50.0/24 to <vigorap_mgmt_ip> port 443
deny  tcp from any to <vigorap_mgmt_ip> port 443
deny  tcp from any to <vigorap_mgmt_ip> port 80