Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:02.770Z",
  "pubdate": "2026-08-24T18:17:02.770Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a critical remote command injection vulnerability residing within the web management interface. Specifically, the flaw exists in the apautotest function, where user-supplied input submitted via the CMD0, CMD3, and CMD6 fields undergoes insufficient input validation and sanitization prior to being passed to the underlying operating system for execution.\nSuccessful exploitation of this vulnerability enables a remote attacker to execute arbitrary system commands with elevated root privileges on the targeted device. This grants the adversary complete administrative control over the affected hardware, potentially leading to total system compromise, network pivoting, and localized persistent access.\nAlthough the attack vector is remotely accessible via the device management interface, exploitation strictly requires the acquisition and utilization of valid administrative credentials. Consequently, the primary risk profile involves authenticated administrative sessions or secondary exploitation chains capable of credential theft or session hijacking.\nMitigation of this risk requires rigorous access control enforcement, restriction of management interfaces to trusted internal networks, and the application of official vendor firmware updates as soon as they are made available by DrayTek.",
  "technicalDetails": "The vulnerability is classified as an OS command injection flaw located within the web management daemon of multiple DrayTek VigorAP models. The vulnerable component is specifically the apautotest function, which handles diagnostic or testing routines within the device firmware. During the processing of requests intended for this function, parameters designated as CMD0, CMD3, and CMD6 fail to undergo rigorous validation, filtering, or escaping before being concatenated or passed directly into system shell invocation routines.\nThe attack flow proceeds as follows: an authenticated remote attacker interacts with the web management interface of the DrayTek VigorAP. The attacker crafts a malicious HTTP request targeting the apautotest endpoint, injecting shell metacharacters and arbitrary commands into one or more of the vulnerable input fields (CMD0, CMD3, or CMD6). Because the application exhibits insufficient input validation, the backend binary executes the constructed command string via the underlying operating system shell.\nPrivilege and authentication requirements dictate that the attacker must possess valid administrative credentials to successfully access the web management interface and reach the vulnerable apautotest function. Once the malicious payload is processed, the injected commands execute with full root privileges, reflecting the security context of the web management daemon or the primary initialization processes.\nThe network exposure includes any interface configured to accept administrative connections, typically the HTTP or HTTPS management ports exposed internally or, insecurely, to the wider internet. The payload behavior allows an adversary to execute arbitrary binaries, modify system configurations, extract sensitive data, or establish persistent backdoors. Post-exploitation impact encompasses total compromise of the affected DrayTek VigorAP device, threatening the integrity and confidentiality of the local network segment managed by the access point."
}