CVE-2026-71912

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-71912", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-08T16:37:44.517Z", "datePublished": "2026-08-24T17:07:44.906Z", "dateUpdated": "2026-08-24T19:01:02.459Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T17:07:44.906Z"}, "datePublic": "2026-08-24T00:00:00.000Z", "title": "DrayTek VigorAP Multiple Models Buffer Overflow via apautotest", "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface."}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-120", "description": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}], "affected": [{"vendor": "DrayTek Corporation", "product": "VigorAP 918R", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.11", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 960C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 1060C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.12", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 906", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.13", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 912C", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.15", "status": "affected", "versionType": "custom"}]}, {"vendor": "DrayTek Corporation", "product": "VigorAP 903", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "1.4.22", "status": "affected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.4.22"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}}], "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: DrayTek VigorAP Multiple Models Buffer Overflow via apautotest", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-buffer-overflow-via-apautotest"}], "credits": [{"lang": "en", "value": "Jincheng Wang (@winmt)", "type": "finder"}, {"lang": "en", "value": "Le Yu (Nanjing University of Posts and Telecommunications)", "type": "finder"}, {"lang": "en", "value": "Xiapu Luo (The Hong Kong Polytechnic University)", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T18:59:52.374944Z", "id": "CVE-2026-71912", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:01:02.459Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-71912", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-24T18:59:52.374944Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T19:00:52.221Z"}}], "cna": {"title": "DrayTek VigorAP Multiple Models Buffer Overflow via apautotest", "credits": [{"lang": "en", "type": "finder", "value": "Jincheng Wang (@winmt)"}, {"lang": "en", "type": "finder", "value": "Le Yu (Nanjing University of Posts and Telecommunications)"}, {"lang": "en", "type": "finder", "value": "Xiapu Luo (The Hong Kong Polytechnic University)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "DrayTek Corporation", "product": "VigorAP 918R", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.11", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 960C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 1060C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.12", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 906", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.13", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 912C", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.15", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "DrayTek Corporation", "product": "VigorAP 903", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.22", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-24T00:00:00.000Z", "references": [{"url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-buffer-overflow-via-apautotest", "name": "VulnCheck Advisory: DrayTek VigorAP Multiple Models Buffer Overflow via apautotest", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:draytek:vigorap_918r_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.11"}, {"criteria": "cpe:2.3:o:draytek:vigorap_960c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.12"}, {"criteria": "cpe:2.3:o:draytek:vigorap_1060c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.12"}, {"criteria": "cpe:2.3:o:draytek:vigorap_906_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.13"}, {"criteria": "cpe:2.3:o:draytek:vigorap_912c_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.15"}, {"criteria": "cpe:2.3:o:draytek:vigorap_903_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.4.22"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-08-24T17:07:44.906Z"}}}, "cveMetadata": {"cveId": "CVE-2026-71912", "state": "PUBLISHED", "dateUpdated": "2026-08-24T19:01:02.459Z", "dateReserved": "2026-08-08T16:37:44.517Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T17:07:44.906Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VigorAP 918R", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.11", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 960C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.12", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 1060C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.12", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 906", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.13", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 912C", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.15", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "VigorAP 903", "vendor": "DrayTek Corporation", "versions": [{"lessThan": "1.4.22", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface."}, {"lang": "es", "value": "M\u00faltiples modelos DrayTek VigorAP contienen una vulnerabilidad de desbordamiento de b\u00fafer en la funci\u00f3n apautotest. La vulnerabilidad es causada por la falta de comprobaciones de longitud durante las operaciones de copia de memoria que involucran el campo CMD6. Un atacante remoto puede desencadenar esta vulnerabilidad a trav\u00e9s de una entrada manipulada, causando una denegaci\u00f3n de servicio o potencialmente ejecutando comandos arbitrarios. La explotaci\u00f3n requiere credenciales administrativas v\u00e1lidas para la interfaz de gesti\u00f3n web del dispositivo."}], "id": "CVE-2026-71912", "lastModified": "2026-10-13T09:10:00.323", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71912", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T18:59:52.374944Z", "version": "2.0.3"}}]}, "published": "2026-08-24T18:17:03.110", "references": [{"source": "disclosure@vulncheck.com", "url": "https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-buffer-overflow-via-apautotest"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 1060C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_1060c", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 903", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_903", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.13)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 906", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_906", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.15)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 912C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_912c", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.11)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 918R", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_918r", "vendor": "draytek"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.12)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "VigorAP 960C", "source": "cna", "vendor": "DrayTek Corporation"}, "product": "vigorap_960c", "vendor": "draytek"}], "created": "2026-08-24T19:00:05.646057+00:00", "updated": "2026-08-24T21:10:02.480447+00:00", "vendors": ["draytek", "draytek$PRODUCT$vigorap_1060c", "draytek$PRODUCT$vigorap_903", "draytek$PRODUCT$vigorap_906", "draytek$PRODUCT$vigorap_912c", "draytek$PRODUCT$vigorap_918r", "draytek$PRODUCT$vigorap_960c"]}