CVE-2026-71906: DrayTek VigorAP Command Injection Vulnerability

CVE-2026-71906 Overview

CVE-2026-71906 is an operating system command injection vulnerability affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the setLan function of the device's web management interface. The lanIp and lanNetmask parameters are passed to system command execution without sufficient input validation. An authenticated remote attacker with administrative credentials can inject shell metacharacters to execute arbitrary commands as root. The weakness is classified under CWE-78: OS Command Injection.

Critical Impact
Successful exploitation grants root-level command execution on affected VigorAP devices, enabling full device takeover, persistent implants, and lateral movement into the internal network.

Affected Products

Multiple DrayTek VigorAP series wireless access point models (see vendor advisory for the complete model and firmware list)
DrayTek VigorAP web management interface, setLan handler
Firmware versions prior to the August 2026 DrayTek security update

Discovery Timeline

2026-08-24 - CVE-2026-71906 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71906

Vulnerability Analysis

The vulnerability exists in the setLan handler exposed through the VigorAP web management interface. The handler accepts LAN configuration parameters from authenticated administrators, including lanIp and lanNetmask. These values are concatenated into shell command strings used to reconfigure network interfaces on the device. Because the values are not validated or escaped, shell metacharacters such as ;, |, backticks, or $() pass through untouched. The injected commands execute in the context of the web server process, which runs as root on VigorAP firmware.

Exploitation requires valid administrative credentials, which limits opportunistic mass exploitation. However, VigorAP devices are frequently deployed with default or weak credentials, and administrative sessions can be captured through phishing or credential reuse. Once an attacker executes commands as root, they can modify firmware, install persistent backdoors, pivot into the LAN, or use the device as a staging point for further intrusion.

Root Cause

The root cause is missing input sanitization in the setLan function. User-supplied values for lanIp and lanNetmask are inserted directly into a command string executed by a shell interpreter. No allowlist validation confirms that the fields contain only valid IPv4 octets and dots before the command is invoked.

Attack Vector

An attacker authenticates to the VigorAP web interface with administrator credentials, either over the LAN or over any network segment where management access is reachable. The attacker submits a crafted request to the setLan endpoint with shell metacharacters embedded in the lanIp or lanNetmask parameter. The device parses the request and executes the injected payload as root.

Because no verified proof-of-concept code has been published, the vulnerability mechanism is described in prose only. For technical specifics, refer to the VulnCheck Advisory on DrayTek and the DrayTek Security Advisory.

Detection Methods for CVE-2026-71906

Indicators of Compromise

Unexpected outbound connections initiated from VigorAP management IP addresses to unknown external hosts.
New or modified files in writable firmware paths on the device, or unexplained reboots following administrative logins.
HTTP or HTTPS POST requests to the setLan endpoint containing shell metacharacters (;, |, &, backticks, $() in the lanIp or lanNetmask fields.

Detection Strategies

Inspect web server and management interface logs on VigorAP devices for setLan requests with non-numeric characters in IP address fields.
Monitor network flows from access point management subnets for anomalous protocols such as reverse shells, DNS tunneling, or unexpected TLS destinations.
Correlate administrator login events with subsequent configuration changes to identify credential-based abuse of the setLan handler.

Monitoring Recommendations

Aggregate syslog output from VigorAP devices into a central log platform and alert on failed and successful administrator authentications.
Baseline expected LAN configuration change frequency and alert on deviations, especially outside maintenance windows.
Track firmware version and configuration hash on each device to detect unauthorized modification.

How to Mitigate CVE-2026-71906

Immediate Actions Required

Apply the DrayTek VigorAP firmware updates released in the August 2026 security advisory to all affected models.
Restrict access to the VigorAP web management interface to trusted management VLANs and jump hosts only.
Rotate all administrator credentials on VigorAP devices and enforce strong, unique passwords.
Audit administrator accounts and remove unused or shared logins that could be used to reach the setLan endpoint.

Patch Information

DrayTek has published fixed firmware in the DrayTek Security Advisory covering multiple remote code execution and buffer overflow issues in the VigorAP series. Administrators should identify each deployed model, obtain the corresponding fixed firmware image from DrayTek, and validate the upgrade in a lab environment before rolling it out to production access points.

Workarounds

Disable remote management on the WAN interface and permit management traffic only from an internal administrative subnet.
Place VigorAP devices behind a firewall rule that limits access to the web management port to specific administrator source IP addresses.
Where patching cannot be performed immediately, temporarily disable administrator accounts that are not actively required for operations.

bash

# Example ACL restricting VigorAP management access to a dedicated admin subnet
# Replace 10.10.50.0/24 with your management network and 192.0.2.10 with the VigorAP IP
iptables -A FORWARD -s 10.10.50.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP