Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Draytek
  • Vigorap 1060c
  • Vigorap 1060c Firmware
  • Vigorap 903
  • Vigorap 903 Firmware
  • Vigorap 906
  • Vigorap 906 Firmware
  • Vigorap 912c
  • Vigorap 912c Firmware
  • Vigorap 918r
  • Vigorap 918r Firmware
  • Vigorap 960c
  • Vigorap 960c Firmware

No data.

No data.

References
Link Providers
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ cve-icon cve-icon
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-exportsettings cve-icon cve-icon
History

Tue, 25 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-22
References

Tue, 25 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences. Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title Volmarg Personal Management System Path Traversal via get-file Endpoint DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
First Time appeared Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
Weaknesses CWE-78
CPEs cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Tue, 25 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-78
References

Tue, 25 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Description Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface. Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed directly to file_get_contents() without canonicalization against a permitted base directory, enabling attackers to retrieve sensitive files accessible to the PHP-FPM worker process without using directory traversal sequences.
Title DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings Volmarg Personal Management System Path Traversal via get-file Endpoint
Weaknesses CWE-22
CPEs cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Mon, 24 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 24 Aug 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Draytek vigorap 1060c
Draytek vigorap 903
Draytek vigorap 906
Draytek vigorap 912c
Draytek vigorap 918r
Draytek vigorap 960c
Vendors & Products Draytek vigorap 1060c
Draytek vigorap 903
Draytek vigorap 906
Draytek vigorap 912c
Draytek vigorap 918r
Draytek vigorap 960c

Mon, 24 Aug 2026 17:30:00 +0000

Type Values Removed Values Added
Description Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and realtime fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Title DrayTek VigorAP Multiple Models OS Command Injection via ExportSettings
First Time appeared Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
Weaknesses CWE-78
CPEs cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigorap 1060c Firmware
Draytek vigorap 903 Firmware
Draytek vigorap 906 Firmware
Draytek vigorap 912c Firmware
Draytek vigorap 918r Firmware
Draytek vigorap 960c Firmware
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published: 2026-08-24T17:07:40.253Z

Updated: 2026-08-25T17:12:38.113Z

Reserved: 2026-08-08T16:37:44.517Z

Link: CVE-2026-71905

cve-icon Vulnrichment

Updated: 2026-08-24T18:31:17.964Z

cve-icon NVD

Status : Deferred

Published: 2026-08-24T18:17:01.890

Modified: 2026-08-26T17:32:25.887

Link: CVE-2026-71905

cve-icon Redhat

No data.