CVE-2026-71908: DrayTek VigorAP Command Injection Vulnerability

CVE-2026-71908 Overview

CVE-2026-71908 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the mesh_start_speed_test function exposed through the device's web management interface. Insufficient sanitization of the meshdevice_index and meshdevice_ip parameters allows attacker-controlled input to reach a shell command execution path. Authenticated remote attackers can inject arbitrary commands that execute with root privileges on the underlying firmware. Exploitation requires valid administrative credentials, but successful attacks yield full device compromise, giving adversaries a foothold to pivot into internal networks or persist across reboots.

Critical Impact
Authenticated attackers can execute arbitrary commands as root on affected DrayTek VigorAP access points, resulting in complete device compromise and potential lateral movement into connected networks.

Affected Products

DrayTek VigorAP series wireless access points (multiple models)
Firmware versions listed in the DrayTek Security Advisory
Deployments exposing the web management interface to untrusted networks

Discovery Timeline

2026-08-24 - CVE-2026-71908 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71908

Vulnerability Analysis

The vulnerability is a classic OS command injection in the mesh management functionality of DrayTek VigorAP firmware. The mesh_start_speed_test handler accepts two user-controlled fields, meshdevice_index and meshdevice_ip, and passes them into a shell command without adequate validation or escaping. An authenticated administrator, or an attacker who has obtained administrative credentials through phishing, credential reuse, or default credentials, can supply shell metacharacters within these fields. The injected payload executes in the context of the web server process, which runs with root privileges on VigorAP firmware. This grants the attacker full control over the device configuration, network traffic, and persistence mechanisms.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. The mesh_start_speed_test function concatenates the meshdevice_index and meshdevice_ip values directly into a command string invoked through a shell rather than using a safe execution API or an allow-list of expected characters. IP address fields should accept only numeric characters and dots, and index fields should accept only integers, but neither constraint is enforced server-side.

Attack Vector

Exploitation occurs over the network against the device's HTTP or HTTPS management interface. The attacker authenticates with valid administrator credentials, then submits a crafted request to the mesh speed test endpoint. Shell metacharacters such as backticks, semicolons, or $() embedded in meshdevice_index or meshdevice_ip are interpreted by the shell, executing attacker-supplied commands. See the VulnCheck Advisory on DrayTek for endpoint and parameter details.

No verified public exploit code is available at this time. Refer to the vendor and VulnCheck advisories for technical specifics.

Detection Methods for CVE-2026-71908

Indicators of Compromise

HTTP or HTTPS requests to the VigorAP mesh management endpoints containing shell metacharacters (;, |, `, $() in the meshdevice_index or meshdevice_ip parameters
Unexpected outbound connections originating from VigorAP devices, particularly to unfamiliar external IP addresses
New or modified processes on the device, or unexplained configuration changes in the web UI
Administrative logins from unusual source IP addresses preceding mesh speed test activity

Detection Strategies

Inspect web management logs for requests to the mesh_start_speed_test handler that include non-numeric characters in index or IP fields
Deploy network intrusion detection signatures that flag command injection patterns targeting DrayTek management URLs
Correlate authentication events with subsequent mesh configuration API calls to identify anomalous administrative sessions

Monitoring Recommendations

Forward VigorAP syslog and web access logs to a centralized SIEM for retention and analysis
Alert on any administrative access to VigorAP devices from outside approved management subnets
Baseline normal mesh management traffic and alert on deviations in request volume or parameter content

How to Mitigate CVE-2026-71908

Immediate Actions Required

Apply the firmware update referenced in the DrayTek Security Advisory to every affected VigorAP model
Rotate all administrative credentials on the device and audit for unauthorized accounts or configuration changes
Restrict access to the web management interface to trusted management VLANs or jump hosts only
Disable remote administrative access from the WAN interface if it is not strictly required

Patch Information

DrayTek has published fixed firmware for the affected VigorAP models. Consult the DrayTek Security Advisory for the precise model-to-version mapping and download links. Verify the running firmware version after upgrade and confirm the mesh functionality operates as expected.

Workarounds

Place VigorAP management interfaces behind a firewall and permit administrative access only from a dedicated management network
Enforce strong, unique administrator passwords and enable multi-factor authentication on any upstream identity provider used for device access
Temporarily disable mesh features on devices that do not require them until firmware can be applied

bash

# Example ACL restricting VigorAP management to a trusted subnet
# Replace 10.10.10.0/24 with your management network and 192.0.2.10 with the AP address
iptables -A FORWARD -s 10.10.10.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP