CVE-2026-71905 is a high severity (CVSS 7.2) OS command injection in the ExportSettings function of several DrayTek VigorAP access points. An attacker with administrator credentials for the web interface can run commands as root. Install the fixed firmware for your model, listed below.
What's affected
Several DrayTek VigorAP models. VulnCheck lists the affected ranges as VigorAP 918R before 1.4.11, 960C and 1060C before 1.4.12, 906 before 1.4.13, 912C before 1.4.15 and 903 before 1.4.22. The DrayTek advisory page, which covers multiple remote code execution and buffer overflow flaws in the VigorAP series, is the authority for the full model list. The CVE record itself lists no products.
The weakness is CWE-78. The advisory text says insufficient filtering of the backupkey, backuptype and realtime fields lets crafted input reach a command that runs with root privileges. Exploitation requires valid administrative credentials for the web management interface.
Severity differs by source: the record scores 7.2 high, and VulnCheck lists 8.6, high, with a CVSS 4.0 vector. Both rest on the same high privilege requirement.
How to check if you're exposed
Log in to the access point's web interface and read the firmware version from the system status page. Compare it with the fixed versions above for your model.
Then look at who can reach the management interface. The attack needs administrator credentials, so the question is how someone could get them. Check whether the web interface is reachable from the internet or from guest and user networks. It should only be reachable from a management network.
Also check the admin password. Default or reused passwords are the usual route to the credentials this flaw requires.
free in-browser dependency scan is for application dependencies, so use the device status page for firmware.
What to do now
- Read the firmware version on each VigorAP and note the model.
- Download the fixed firmware from DrayTek for your model and install it.
- Turn off remote management from the internet.
- Limit the management interface to a dedicated management network.
- Replace default or shared admin passwords with unique ones.
Why it matters
CWE-78 means that text a user supplies reaches a shell command without being made safe. Embedded devices are full of these, because firmware often builds commands as strings for tools like backup and archive utilities. Here the export function feeds three request fields into a command that runs as root.
The high privilege requirement is the main limit. It makes this an escalation after credential theft more than an entry point, and a router or access point with root control gives an attacker a place to watch and change network traffic. Credential hygiene and management network isolation are the controls that keep this theoretical.
Quick check
Can someone exploit this without logging in?
Not according to the advisory text. It says exploitation requires valid administrative credentials for the web management interface.
Sources
Last reviewed: 18 October 2026.
