CVE-2026-71909 Overview
CVE-2026-71909 is an operating system command injection vulnerability [CWE-78] affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the InquierTime function, which fails to sanitize input passed through the time field before executing shell commands. An authenticated remote attacker can inject arbitrary commands that run with root privileges on the device. Exploitation requires valid administrative credentials for the web management interface, which limits opportunistic abuse but leaves the flaw dangerous in scenarios involving default credentials, credential theft, or insider threats.
Critical Impact
Successful exploitation yields root-level command execution on affected DrayTek VigorAP devices, allowing full compromise of the access point and pivoting into adjacent network segments.
Affected Products
- DrayTek VigorAP series (multiple models per vendor advisory)
- Web management interface exposing the InquierTime function
- Firmware versions listed in the DrayTek August 2026 security advisory
Discovery Timeline
- 2026-08-24 - CVE-2026-71909 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-71909
Vulnerability Analysis
The vulnerability exists in the InquierTime function within the VigorAP web management interface. The function accepts a time parameter from HTTP requests and passes it into a shell command execution path without adequate filtering or escaping. Because the function runs in the context of the device's root-privileged web daemon, injected shell metacharacters allow attackers to append or chain additional commands. Exploitation requires an authenticated session with administrator credentials, matching the CVSS attack requirements of high privileges and no user interaction.
Root Cause
The root cause is insufficient input validation before command construction in InquierTime. Neither allow-list validation nor safe API primitives such as execve-style argument arrays are used. Shell metacharacters like ;, &&, backticks, and $() reach the command interpreter, enabling injection [CWE-78].
Attack Vector
An attacker authenticates to the VigorAP web interface and issues a crafted HTTP request targeting the endpoint that invokes InquierTime. The time field contains injected shell syntax. The device executes the injected payload as root, enabling command execution, firmware modification, credential theft from configuration files, and use of the access point as a pivot into internal networks.
See the DrayTek Security Advisory and VulnCheck Advisory for full technical details.
Detection Methods for CVE-2026-71909
Indicators of Compromise
- HTTP POST requests to VigorAP management endpoints containing shell metacharacters (;, |, &, backticks, $()) in the time parameter
- Unexpected outbound connections originating from access point IP addresses
- New or modified files in device configuration storage between firmware refreshes
- Administrative logins from unusual source IPs or at unusual times preceding suspicious HTTP requests
Detection Strategies
- Inspect web application firewall and network logs for requests to InquierTime handlers containing non-numeric characters in the time field
- Correlate authenticated admin sessions on VigorAP devices with subsequent outbound traffic anomalies
- Deploy signature-based network detections that match shell injection patterns in HTTP request bodies destined for management interfaces
Monitoring Recommendations
- Forward VigorAP syslog and web access logs to a centralized SIEM for retention and correlation
- Alert on any administrative authentication to VigorAP devices from outside approved management networks
- Baseline expected outbound flows from access points and alert on deviations such as connections to non-DrayTek or non-NTP destinations
How to Mitigate CVE-2026-71909
Immediate Actions Required
- Apply the firmware update referenced in the DrayTek August 2026 security advisory to every affected VigorAP model
- Restrict access to the VigorAP web management interface to trusted management VLANs or jump hosts only
- Rotate all administrative credentials and disable any default or shared accounts on affected devices
- Audit recent administrative sessions and web access logs for signs of exploitation prior to patching
Patch Information
DrayTek released firmware updates addressing this vulnerability alongside related buffer overflow issues. Consult the DrayTek Security Advisory for the fixed firmware versions applicable to each VigorAP model and follow the vendor upgrade procedure.
Workarounds
- Disable remote management (WAN-side access) to the web administration interface until firmware can be applied
- Enforce network segmentation so VigorAP management interfaces are unreachable from user, guest, and untrusted networks
- Require multi-factor authentication on jump hosts used to reach the VigorAP administrative UI to raise the bar against credential-based exploitation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
