CVE-2026-71913
Last modified
CVE-2026-71913 is a high-severity vulnerability rated 7.2/10 on the CVSS scale. Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. EPSS estimates a 2.40% chance of exploitation in the next 30 days.
Description
Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| DrayTek Corporation | VigorAP 918R | < 1.4.11 |
| DrayTek Corporation | VigorAP 960C | < 1.4.12 |
| DrayTek Corporation | VigorAP 1060C | < 1.4.12 |
| DrayTek Corporation | VigorAP 906 | < 1.4.13 |
| DrayTek Corporation | VigorAP 912C | < 1.4.15 |
| DrayTek Corporation | VigorAP 903 | < 1.4.22 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-71913?
How severe is CVE-2026-71913?
How do I fix CVE-2026-71913?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-71908Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71909Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-7191Improper use of the static-eval npm package in the open sour…8.6
- CVE-2026-71910Multiple DrayTek VigorAP models contain a command injection …7.2
- CVE-2026-71911Multiple DrayTek VigorAP models contain a buffer overflow vu…7.2
- CVE-2026-71912Multiple DrayTek VigorAP models contain a buffer overflow vu…7.2
- CVE-2026-71914Multiple DrayTek VigorAP models contain a command injection …9.8
- CVE-2026-71915Multiple DrayTek VigorSwitch models contain a command inject…7.2
- CVE-2026-71916Multiple DrayTek VigorSwitch models contain a command inject…7.2
- CVE-2026-71917Multiple DrayTek VigorSwitch models contain a command inject…7.2
- CVE-2026-71918Multiple DrayTek VigorSwitch models contain a command inject…7.2
- CVE-2026-71919Multiple DrayTek VigorSwitch models contain a command inject…7.2
Are you affected by CVE-2026-71913?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST