CVE-2026-71909

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71909", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-08T16:37:44.517Z", "datePublished": "2026-08-24T17:07:42.940Z", "dateUpdated": "2026-08-24T19:53:01.368Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T17:07:42.940Z"}, "datePublic": "2026-08-24T00:00:00.000Z", "title": "DrayTek VigorAP Multiple Models OS Command Injection via InquierTime", "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "type": "CWE"}]}], "affected": [{"vendor": "DrayTek Corporation", "product": "VigorAP 918R", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.11", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 960C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 1060C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 906", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.13", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 912C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.15", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 903", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.22", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.22"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: DrayTek VigorAP Multiple Models OS Command Injection via InquierTime", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-inquiertime"}], "credits": [{"lang": "en", "value": "Jincheng Wang (@winmt)", "type": "finder"}, {"lang": "en", "value": "Le Yu (Nanjing University of Posts and Telecommunications)", "type": "finder"}, {"lang": "en", "value": "Xiapu Luo (The Hong Kong Polytechnic University)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T19:52:52.186937Z", "id": "CVE-2026-71909", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:53:01.368Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71909", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T19:52:52.186937Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:52:57.469Z"}}], "cna": {"title": "DrayTek VigorAP Multiple Models OS Command Injection via InquierTime", "credits": [{"lang": "en", "type": "finder", "value": "Jincheng Wang (@winmt)"}, {"lang": "en", "type": "finder", "value": "Le Yu (Nanjing University of Posts and Telecommunications)"}, {"lang": "en", "type": "finder", "value": "Xiapu Luo (The Hong Kong Polytechnic University)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "DrayTek Corporation", "product": "VigorAP 918R", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.11", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 960C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 1060C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 906", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.13", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 912C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 903", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.22", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-24T00:00:00.000Z", "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-inquiertime", "name": "VulnCheck Advisory: DrayTek VigorAP Multiple Models OS Command Injection via InquierTime", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.11"}, {"criteria": "cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.12"}, {"criteria": "cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.12"}, {"criteria": "cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.13"}, {"criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.15"}, {"criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.22"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T17:07:42.940Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71909", "state": "PUBLISHED", "dateUpdated": "2026-08-24T19:53:01.368Z", "dateReserved": "2026-08-08T16:37:44.517Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T17:07:42.940Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VigorAP 918R", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.11", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 960C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.12", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 1060C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.12", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 906", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.13", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 912C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.15", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 903", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface."}, {"lang": "es", "value": "M\u00faltiples modelos DrayTek VigorAP contienen una vulnerabilidad de inyecci\u00f3n de comandos en la funci\u00f3n InquierTime. La vulnerabilidad es causada por un filtrado insuficiente del campo time antes de la ejecuci\u00f3n de comandos. Un atacante remoto puede activar esta vulnerabilidad a trav\u00e9s de una entrada manipulada para ejecutar comandos arbitrarios con privilegios de root. La explotaci\u00f3n requiere credenciales administrativas v\u00e1lidas para la interfaz de gesti\u00f3n web del dispositivo."}], "id": "CVE-2026-71909", "lastModified": "2026-10-13T09:10:00.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71909", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T19:52:52.186937Z", "version": "2.0.3"}}]}, "published": "2026-08-24T18:17:02.593", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-inquiertime"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 1060C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_1060c", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 903", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_903", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 906", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_906", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 912C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_912c", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 918R", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_918r", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 960C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_960c", "vendor": "draytek"}], "created": "2026-08-24T19:00:05.646762+00:00", "updated": "2026-08-25T14:45:03.948354+00:00", "vendors": ["draytek", "draytek$PRODUCT$vigorap_1060c", "draytek$PRODUCT$vigorap_903", "draytek$PRODUCT$vigorap_906", "draytek$PRODUCT$vigorap_912c", "draytek$PRODUCT$vigorap_918r", "draytek$PRODUCT$vigorap_960c"]}