Description

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-24T18:17:03.300Z",
  "pubdate": "2026-08-24T18:17:03.300Z",
  "executiveSummary": "Multiple DrayTek VigorAP models suffer from a critical command injection vulnerability located within the upload_settings.cgi interface.\nThe vulnerability stems from the application's failure to adequately sanitize user-supplied input before passing it into system shell commands.\nA remote authenticated attacker possessing valid administrative credentials can exploit this flaw by sending crafted input through the restorekey field.\nSuccessful exploitation results in the execution of arbitrary system commands with root privileges, leading to full device compromise.\nThe risk implication is severe, as an attacker with administrative access can leverage this flaw to completely hijack the affected networking hardware, manipulate configurations, intercept traffic, or pivot further into the internal network.\nExploitation strictly requires valid administrative credentials for the device's web management interface, mitigating unauthenticated exploitation vectors.",
  "technicalDetails": "The vulnerability resides in the upload_settings.cgi interface of multiple DrayTek VigorAP models, specifically within the handling of the restorekey parameter.\nThe root cause of the security defect is insufficient input validation and filtering, where user-supplied data originating from the restorekey field is directly concatenated into an underlying shell command string without proper escaping or parameterization.\nBecause the web management interface processes these operations with elevated system privileges, the injected command inherits root execution context.\nThe attack flow proceeds as follows: First, the remote attacker must authenticate to the web management interface of the target DrayTek VigorAP using valid administrative credentials. Second, the attacker navigates or crafts an HTTP request targeting the upload_settings.cgi endpoint. Third, the attacker injects malicious shell metacharacters and payloads into the restorekey input field. Fourth, the backend application processes the request, directly concatenates the unsanitized input into a shell command execution function, and executes the arbitrary payload.\nThe vulnerable component is the CGI binary or script handling configuration uploads and setting restorations, specifically parsing the upload_settings.cgi route.\nNetwork exposure is defined by the accessibility of the web management interface, which is typically exposed locally on the management LAN and potentially via WAN if remote management is misconfigured.\nPayload behavior involves executing arbitrary OS commands in the context of the root user, bypassing intended application logic.\nPost-exploitation impact includes complete system compromise, firmware modification, persistent backdoor installation, denial of service, and unauthorized manipulation of network traffic traversing the access point."
}