Description
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Published: 2026-08-24
Score: 8.6 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title DrayTek VigorAP Multiple Models OS Command Injection via InquierTime
First Time appeared Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
Weaknesses CWE-78
CPEs cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Draytek Vigorap 1060c Firmware Vigorap 903 Firmware Vigorap 906 Firmware Vigorap 912c Firmware Vigorap 918r Firmware Vigorap 960c Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-24T19:53:01.368Z

Reserved: 2026-08-08T16:37:44.517Z

Link: CVE-2026-71909

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-24T18:17:02.593

Modified: 2026-08-24T18:17:02.593

Link: CVE-2026-71909

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-24T19:00:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')