CVE-2026-71908DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
Updated under an hour ago ()
Does this affect you?
It affects DrayTek Corporation VigorAP 918R and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
- CVSS
- 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-78
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Aug 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
DrayTek Corporation VigorAP 918R draytek:vigorap_918r (from the name) | before 1.4.11 | CNA record |
DrayTek Corporation VigorAP 960C draytek:vigorap_960c (from the name) | before 1.4.12 | CNA record |
DrayTek Corporation VigorAP 1060C draytek:vigorap_1060c (from the name) | before 1.4.12 | CNA record |
DrayTek Corporation VigorAP 906 draytek:vigorap_906 (from the name) | before 1.4.13 | CNA record |
DrayTek Corporation VigorAP 912C draytek:vigorap_912c (from the name) | before 1.4.15 | CNA record |
DrayTek Corporation VigorAP 903 draytek:vigorap_903 (from the name) | before 1.4.22 | CNA record |
References
- https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/vendor-advisory
- https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-mesh-start-speed-testthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.