CVE-2026-71908CWE-78command-injection

CVE-2026-71908

High · published August 24, 2026

CVSS v3.1
7.2
EPSS
2%
Percentile
82.8
In the wild
Unconfirmed
What it is

Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.02265 · 82.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-08-24T22:17Z
References (2)
https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/ · [email protected]https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-mesh-start-speed-test · [email protected]
EPSS history
Timeline
  • 26 AUG 08:24Z
    EPSS moved — → 3%
    epss
  • 24 AUG 17:07Z
    DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test
    cvelistv5