CVE-2026-71913High· 7.2▾ Twilight

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score40/ 100 · Moderate

impact 39.6 · likelihood 0.4 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 24, 2026

Updated

Oct 13, 2026

CVSS

7.2

Vendor

—

Product

—

CWE

CWE-78

Depth score

40 · Moderate

EPSS

1.8% · p78

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Oct 13.

1.8% → 1.8%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 50 days

Aug 24, 2026Published
Disclosed via NVD
Oct 13, 2026Record revised
Last analysed / modified upstream
Oct 13, 2026EPSS first tracked
1.8%

CWE-78 #nvd

Full technical detail▾

Overview

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed