CVE-2026-71912: DrayTek VigorAP Buffer Overflow Vulnerability

CVE-2026-71912 Overview

CVE-2026-71912 is a buffer overflow vulnerability affecting multiple DrayTek VigorAP wireless access point models. The flaw resides in the apautotest function, which fails to validate the length of input during memory copy operations involving the CMD6 field. An authenticated remote attacker can send crafted input to the web management interface to trigger the overflow. Successful exploitation can cause denial of service or arbitrary command execution on the device. The vulnerability is tracked under CWE-120 (Buffer Copy without Checking Size of Input).

Critical Impact
An authenticated remote attacker can corrupt memory in the apautotest handler and potentially execute arbitrary commands on affected VigorAP devices, resulting in full device compromise.

Affected Products

Multiple DrayTek VigorAP series wireless access points (see vendor advisory for model list)
VigorAP firmware versions prior to the August 2026 security patch
Devices exposing the web management interface to reachable networks

Discovery Timeline

2026-08-24 - CVE-2026-71912 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-71912

Vulnerability Analysis

The vulnerability exists in the apautotest function exposed through the DrayTek VigorAP web management interface. The function processes a request parameter identified as the CMD6 field and copies its contents into a fixed-size buffer without validating the input length. An attacker who supplies an oversized CMD6 value overwrites adjacent memory regions on the stack or heap, depending on the target model. This corruption can crash the device management service or, with a carefully crafted payload, redirect execution flow to attacker-controlled code. Because VigorAP devices typically run network services as privileged system processes, successful code execution grants control over the access point and its traffic.

Root Cause

The root cause is missing bounds checking during memory copy operations in the apautotest handler. The function trusts the length of the CMD6 field supplied over the network rather than enforcing the destination buffer size. This pattern maps directly to CWE-120, a classic buffer copy without input size validation.

Attack Vector

Exploitation is remote over the network but requires valid administrative credentials for the VigorAP web management interface. An attacker with admin access sends a crafted HTTP request to the endpoint that invokes apautotest, embedding an oversized CMD6 value. The overflow triggers either a service crash resulting in denial of service or, with a tuned payload, arbitrary command execution in the context of the management process. Devices exposed to the internet or accessible from untrusted network segments increase the practical risk, particularly where default or weak administrative credentials remain in use.

No verified public proof-of-concept code is available. Technical details are described in the DrayTek Security Advisory and the VulnCheck Buffer Overflow Advisory.

Detection Methods for CVE-2026-71912

Indicators of Compromise

Unexpected reboots or crashes of VigorAP devices coinciding with HTTP requests to management endpoints
HTTP requests to the VigorAP management interface containing unusually long CMD6 parameter values
New or unexplained administrator sessions to the VigorAP web interface from unfamiliar source IPs
Configuration changes on VigorAP devices that do not correlate with authorized administrative activity

Detection Strategies

Inspect web access logs from VigorAP devices for POST or GET requests referencing apautotest with oversized parameter payloads
Correlate authentication events on VigorAP administrative accounts with subsequent management-plane requests from the same source
Alert on repeated 5xx responses or session terminations from the VigorAP management service, which may indicate crash-based probing

Monitoring Recommendations

Forward VigorAP syslog and management access logs to a centralized logging platform for retention and analysis
Track outbound connections initiated by VigorAP devices to detect command execution artifacts such as reverse shells or tool downloads
Monitor firmware version inventory across all deployed VigorAP units to confirm patch coverage

How to Mitigate CVE-2026-71912

Immediate Actions Required

Apply the firmware update referenced in the DrayTek Security Advisory to all affected VigorAP models
Rotate administrative credentials on VigorAP devices and disable any unused administrative accounts
Restrict access to the VigorAP web management interface to trusted management VLANs or jump hosts
Audit recent administrative logins and configuration changes on all VigorAP devices for signs of abuse

Patch Information

DrayTek released firmware updates addressing this vulnerability in August 2026. Refer to the DrayTek Security Advisory for the definitive list of affected models and fixed firmware versions. Additional analysis is available in the VulnCheck Buffer Overflow Advisory.

Workarounds

Disable remote access to the VigorAP web management interface from WAN and untrusted networks until firmware can be applied
Enforce strong, unique administrative passwords and enable account lockout policies where supported
Place VigorAP management interfaces behind an isolated management network reachable only through authenticated jump hosts or VPN
Segment access points from user and server networks to limit lateral movement if a device is compromised

bash

# Example: restrict VigorAP management access at an upstream firewall
# Replace interface, management VLAN, and device IPs to match your environment
iptables -A FORWARD -s 10.10.20.0/24 -d 192.0.2.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.10 -p tcp --dport 80 -j DROP