Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:02.593Z",
  "pubdate": "2026-08-24T18:17:02.593Z",
  "executiveSummary": "A command injection vulnerability exists within multiple DrayTek VigorAP models, specifically residing in the InquierTime function of the device firmware. This security flaw stems from the failure to adequately sanitize and filter input parameters supplied to the time field before they are processed and passed to the underlying operating system for execution.\nThe primary impact of this vulnerability is the complete compromise of the affected hardware appliance. A remote threat actor who successfully exploits this flaw can execute arbitrary system commands directly on the underlying host operating system.\nExploitation of this vulnerability requires the attacker to possess valid administrative credentials to successfully authenticate against the device's web management interface. Despite this authentication prerequisite, the risk implications remain severe because successful exploitation yields root-level privileges, granting the attacker unrestricted control over the affected network device.\nAffected systems are limited to the specified DrayTek VigorAP models implementing the vulnerable InquierTime function within their web administration architecture. Organizations utilizing these wireless access points face potential risks including complete device takeover, interception or manipulation of wireless network traffic, and potential pivoting into internal network segments if the compromised access point is leveraged as a foothold.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the InquierTime function of multiple DrayTek VigorAP models. The root cause of the vulnerability is insufficient input validation and improper sanitization of the time field. When the application processes user-supplied data intended for this field, it fails to strip or escape shell metacharacters before passing the string to a system execution sink.\nThe vulnerable component is the web management interface handling administrative backend routines associated with time configuration and inquiry requests. The network exposure is remote, accessible via the HTTP or HTTPS management services exposed by the device, though exploitation strictly requires valid administrative credentials to bypass authentication boundaries.\nThe attack flow proceeds in a sequential manner. First, the remote attacker authenticates to the device's web management interface using acquired or compromised administrative credentials. Second, the attacker crafts a malicious HTTP request targeting the InquierTime function, injecting arbitrary system command syntax into the vulnerable time parameter alongside standard input. Third, the application receives the crafted payload and improperly passes the unsanitized string into a system shell execution context.\nUpon execution, the underlying operating system interprets the injected shell metacharacters and executes the attacker's payload with root privileges. Because the web management daemon typically operates with elevated system rights, the resulting command execution inherits root-level privileges. Post-exploitation impact includes full administrative ownership of the appliance, potential firmware tampering, persistent backdoor installation, denial of service through system resource exhaustion, and unauthorized inspection of local network traffic traversing the VigorAP device."
}