Description

Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:03.110Z",
  "pubdate": "2026-08-24T18:17:03.110Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a stack-based buffer overflow vulnerability residing within the apautotest function of the device firmware. The root cause of this security defect stems from the absence of explicit bounds and length validation checks during memory copy operations that process the CMD6 input field. A remote threat actor who has successfully authenticated with valid administrative credentials against the web management interface can supply maliciously crafted input to this vulnerable parameter. Successful exploitation of this flaw introduces significant risk implications, allowing the adversary to disrupt availability by triggering a denial of service condition, or potentially achieve arbitrary command execution under the privileges of the underlying web service or administrative context. The attack vector targets the device management plane exposed over the network, necessitating prior acquisition of high-privilege administrative access credentials. Consequently, organizations utilizing affected DrayTek VigorAP models face potential system destabilization and administrative compromise if unauthorized entities acquire management credentials or exploit compromised sessions to deliver the malicious payload.",
  "technicalDetails": "The vulnerability is localized within the apautotest function handling internal diagnostic and automated testing routines inside the firmware of multiple DrayTek VigorAP models. The vulnerable component fails to enforce proper input sanitization and boundary checking mechanisms when copying data derived from the CMD6 field into fixed-size memory buffers allocated on the stack or heap. Because the memory copy routine accepts input of arbitrary length without validating it against the destination buffer capacity, an overflow condition occurs when the input size exceeds the allocated storage boundary. This permits the overwriting of adjacent memory regions, including saved frame pointers and return addresses, depending on the memory layout of the affected binary.\nThe attack flow requires the threat actor to establish network connectivity to the web management interface of the target DrayTek VigorAP device. Prior to triggering the vulnerability, the attacker must satisfy the authentication requirements by obtaining and utilizing valid administrative credentials to access the management panel where the apautotest function is exposed. Once authenticated, the attacker transmits a crafted HTTP request or RPC payload containing an oversized value within the CMD6 parameter. Upon receiving the input, the apautotest function processes the request and executes the insecure memory copy operation, passing the malicious payload directly into the vulnerable buffer without length verification.\nThe payload behavior involves supplying a sequence of bytes designed to corrupt critical control data structures within the application execution context. Depending on the precise memory layout and platform mitigations present in the firmware, this memory corruption manifests either as an immediate application crash resulting in a denial of service via segmentation faults or watchdog resets, or as a hijack of the instruction pointer. If control flow hijacking is achieved, the injected shellcode or return-oriented programming payload executes arbitrary commands with the security context of the affected process, leading to full system compromise. The network exposure is restricted to interfaces hosting the web management service, typically HTTP or HTTPS ports exposed to local or wide area networks, and requires high-privilege administrative privileges to successfully reach the vulnerable code path."
}