Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:02.243Z",
  "pubdate": "2026-08-24T18:17:02.243Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a critical command injection vulnerability located within the setcamset function of the device firmware. This security flaw stems from the insufficient input sanitization and validation applied to the selectSlaves field prior to passing the data into system command execution routines.\nSuccessful exploitation of this vulnerability allows a remote authenticated attacker to execute arbitrary system commands with absolute root privileges on the underlying operating system.\nThe primary risk implication is a complete administrative compromise of the affected wireless access point, potentially enabling persistent unauthorized access, lateral movement within the connected local area network, and the manipulation of network traffic traversing the device.\nAttacker capabilities include full system control and arbitrary OS command execution. However, exploitation strictly requires the acquisition and utilization of valid administrative credentials to successfully access the web management interface of the target device prior to triggering the vulnerable function.",
  "technicalDetails": "The vulnerability resides in the web management interface of multiple DrayTek VigorAP models, specifically within the backend handling of the setcamset function. The root cause of the flaw is improper input validation and insufficient sanitization of user-supplied parameters, specifically the selectSlaves field, before the input is concatenated or passed directly to underlying operating system shell execution functions.\nBecause the application fails to adequately strip or escape shell metacharacters and command separators from the selectSlaves input vector, an authenticated user can inject arbitrary shell commands directly into the parameter string.\nThe attack flow proceeds as follows: First, the remote attacker must authenticate to the web management interface of the target DrayTek VigorAP using valid administrative credentials. Second, the attacker crafts a malicious HTTP request targeting the setcamset function, embedding the payload containing arbitrary system commands within the selectSlaves field. Third, the web application processes the request and forwards the unsanitized input to the system shell for execution. Finally, the injected commands are executed by the underlying operating system interpreter.\nThe vulnerable component is the administrative web management daemon responsible for processing the setcamset routine and interacting with the system shell. Network exposure is present via the remote web management interface, typically accessible over HTTP or HTTPS depending on the device configuration.\nThe authentication requirement for this vulnerability is valid administrative credentials, and the privilege requirement for the execution phase is root, as the web management daemon or its spawned subprocesses execute with root privileges.\nThe payload behavior involves the immediate execution of arbitrary system-level commands in the context of the root user upon processing the crafted HTTP request. The post-exploitation impact includes full system compromise, modification of system configurations, installation of persistent backdoors, and potential exploitation of adjacent network infrastructure."
}