CVE-2026-71910
Last modified
CVE-2026-71910 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. EPSS estimates a 3.05% chance of exploitation in the next 30 days.
Description
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| DrayTek Corporation | VigorAP 918R | < 1.4.11 |
| DrayTek Corporation | VigorAP 960C | < 1.4.12 |
| DrayTek Corporation | VigorAP 1060C | < 1.4.12 |
| DrayTek Corporation | VigorAP 906 | < 1.4.13 |
| DrayTek Corporation | VigorAP 912C | < 1.4.15 |
| DrayTek Corporation | VigorAP 903 | < 1.4.22 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-71910?
How severe is CVE-2026-71910?
How do I fix CVE-2026-71910?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71905Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71906Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71907Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71908Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71909Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-7191Improper use of the static-eval npm package in the open sour…8.6
- CVE-2026-71911Multiple DrayTek VigorAP models contain a buffer overflow vu…7.2
- CVE-2026-71912Multiple DrayTek VigorAP models contain a buffer overflow vu…7.2
- CVE-2026-71913Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71914Multiple DrayTek VigorAP models contain a command injection …9.8
- CVE-2026-71915Multiple DrayTek VigorSwitch models contain a command inject…7.2
- CVE-2026-71916Multiple DrayTek VigorSwitch models contain a command inject…7.2
Are you affected by CVE-2026-71910?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST