Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:02.067Z",
  "pubdate": "2026-08-24T18:17:02.067Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a critical command injection vulnerability localized within the setLan function of the device's firmware. This security flaw stems from inadequate input validation and sanitization procedures applied to the lanIp and lanNetmask parameters prior to passing them into system command execution routines.\nSuccessful exploitation of this vulnerability empowers a remote threat actor to execute arbitrary operating system commands with elevated root privileges on the underlying host operating system. The realization of this attack vector directly undermines the confidentiality, integrity, and availability of the affected wireless access point infrastructure.\nTo achieve successful exploitation, the adversary must possess valid administrative credentials granting access to the web management interface of the target device. Consequently, the threat model primarily involves authenticated attackers, such as malicious insiders or external actors who have successfully compromised administrative authentication tokens through credential stuffing, phishing, or default password reuse.\nGiven the severity of root-level command execution, affected organizations face critical risks, including complete device takeover, persistence mechanism establishment, and potential pivoting into internal network segments attached to the management interface. Remediation requires deploying vendor-supplied firmware updates containing proper input validation controls for LAN configuration parameters.",
  "technicalDetails": "The vulnerability resides in the internal setLan function utilized by multiple DrayTek VigorAP models to process local area network configuration changes submitted via the web management interface. The root cause is categorized as an improper neutralization of special elements used in an OS command, commonly known as command injection. Specifically, the software fails to adequately validate, filter, or escape user-supplied input contained within the lanIp and lanNetmask fields before incorporating these variables into system-level execution calls.\nThe attack vector is network-accessible, requiring the target's web management interface to be reachable by the attacker. Exploitation prerequisites mandate that the attacker possesses valid administrative credentials to authenticate successfully to the administrative web panel. Without authenticated session tokens or valid administrator credentials, direct interaction with the vulnerable setLan function is typically restricted by session management controls.\nThe step-by-step attack flow initiates when the authenticated adversary crafts a malicious HTTP request targeting the setLan endpoint. Within this request, the attacker injects shell metacharacters or command separators (such as semicolons, pipes, or backticks) appended or embedded within the lanIp or lanNetmask input fields. Upon receipt, the web application backend parses the configuration payload and passes the unvalidated parameters directly to an underlying system shell or interpreter function.\nBecause the execution context runs with the highest privilege level, any injected shell commands are executed immediately as the root user. The payload behavior can range from executing diagnostic binaries and deploying reverse shells to modifying system binaries and disabling logging mechanisms. The post-exploitation impact grants the attacker total control over the DrayTek VigorAP device, enabling them to manipulate network traffic, intercept wireless communications, establish persistent backdoors, and utilize the compromised access point as a staging point to attack adjacent network assets."
}