CVE-2026-71909High· 7.2▾ Twilight

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.5 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 24, 2026

Updated

Oct 13, 2026

CVSS

7.2

Vendor

—

Product

—

CWE

CWE-78

Depth score

40 · Moderate

EPSS

2.3% · p83

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 13.

2.3% → 2.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 50 days

Aug 24, 2026Published
Disclosed via NVD
Oct 13, 2026Record revised
Last analysed / modified upstream
Oct 13, 2026EPSS first tracked
2.3%

CWE-78 #nvd

Full technical detail▾

Overview

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed