CVE-2026-71907: DrayTek VigorAP Command Injection RCE Flaw

CVE-2026-71907 Overview

CVE-2026-71907 is a command injection vulnerability affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the setcamset function, which fails to filter the selectSlaves field before passing it to command execution. An authenticated remote attacker with administrative credentials to the web management interface can execute arbitrary commands as root. The vulnerability is classified under CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Critical Impact
Successful exploitation grants root-level command execution on affected DrayTek VigorAP devices, allowing full device compromise, persistence, and pivoting into the internal network.

Affected Products

Multiple DrayTek VigorAP series wireless access points (see vendor advisory for the full model list)
Devices exposing the web management interface where the setcamset function is reachable
Firmware versions prior to the DrayTek August 2026 security release

Discovery Timeline

2026-08-24 - CVE-2026-71907 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71907

Vulnerability Analysis

The vulnerability exists in the setcamset handler exposed by the VigorAP web management interface. The handler accepts a selectSlaves parameter that is subsequently concatenated into a shell command without adequate sanitization. Because the web daemon on the affected devices runs with root privileges, injected commands inherit those privileges.

Exploitation requires authenticated access as an administrator. However, DrayTek access points are frequently deployed with weak or default administrative credentials, and administrative sessions can be captured or reused. Successful exploitation converts an administrative foothold into full operating-system control.

Root Cause

The root cause is insufficient input filtering on the selectSlaves field within the setcamset function. The application treats attacker-controlled input as trusted shell syntax and passes it to a system shell. Shell metacharacters such as ;, |, &, and backticks are not neutralized, allowing arbitrary command chaining.

Attack Vector

The attack vector is network-based and targets the HTTP/HTTPS web management interface of the access point. An attacker first authenticates with valid administrator credentials, then submits a crafted request to the endpoint invoking setcamset with a malicious selectSlaves value. The injected payload runs under the web server's root context, enabling arbitrary binary execution, configuration tampering, and persistent backdoor installation.

No public proof-of-concept has been published at the time of writing. Details are documented in the DrayTek Security Advisory and the VulnCheck DrayTek Advisory.

Detection Methods for CVE-2026-71907

Indicators of Compromise

HTTP or HTTPS POST requests to the VigorAP management interface that reference the setcamset action and contain shell metacharacters in the selectSlaves parameter.
Unexpected child processes spawned by the device's web daemon, particularly sh, busybox, wget, curl, or tftp invocations.
New or modified files in writable firmware locations, cron entries, or startup scripts on the access point.
Outbound connections from the access point to previously unseen external hosts.

Detection Strategies

Inspect network traffic to the VigorAP management interface for anomalous setcamset requests, focusing on the selectSlaves field.
Correlate administrator login events with configuration changes and immediately subsequent outbound connections from the device.
Baseline expected management traffic and alert on deviations, since access points rarely receive administrative traffic from unusual sources.

Monitoring Recommendations

Forward VigorAP syslog to a centralized logging platform and retain authentication and configuration-change events.
Monitor for repeated failed administrative logins that may precede credential-based exploitation.
Alert on any egress from access-point management IPs to internet destinations outside vendor update infrastructure.

How to Mitigate CVE-2026-71907

Immediate Actions Required

Apply the DrayTek firmware update referenced in the August 2026 VigorAP security advisory to all affected models.
Rotate administrator credentials on every VigorAP device and remove any shared or default accounts.
Restrict access to the web management interface to trusted management VLANs or jump hosts using ACLs.
Audit device configuration and running state for evidence of prior compromise before returning devices to production.

Patch Information

DrayTek has released fixed firmware for the affected VigorAP models as part of its August 2026 security update. Administrators should consult the DrayTek Security Advisory for the specific firmware version corresponding to each model and apply the update through the vendor's standard upgrade process.

Workarounds

Disable remote administration and limit the web management interface to a dedicated management network until firmware can be applied.
Enforce strong, unique administrator passwords and enable account lockout thresholds where supported.
Place VigorAP management interfaces behind a firewall that blocks unsolicited inbound HTTP and HTTPS from user or guest networks.

bash

# Example ACL restricting VigorAP management access to a management subnet
# Replace 10.10.0.0/24 with your management network and 192.0.2.10 with the AP IP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 443 -j DROP
iptables -A FORWARD -p tcp -d 192.0.2.10 --dport 80  -j DROP