High 7.2Published Aug 24, 2026

CVE-2026-71909DrayTek VigorAP Multiple Models OS Command Injection via InquierTime

Updated under an hour ago (Oct 27, 2026, 4:30 PM ET)

Does this affect you?

It affects DrayTek Corporation VigorAP 918R and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for DrayTek Corporation VigorAP 918R

Exploited in the last 30 days

Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

CVSS: 7.2 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-78
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulnCheck
NVD analysis: Deferred
Record last updated: Aug 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

DrayTek Corporation VigorAP 918R draytek:vigorap_918r (from the name)	before 1.4.11	CNA record
DrayTek Corporation VigorAP 960C draytek:vigorap_960c (from the name)	before 1.4.12	CNA record
DrayTek Corporation VigorAP 1060C draytek:vigorap_1060c (from the name)	before 1.4.12	CNA record
DrayTek Corporation VigorAP 906 draytek:vigorap_906 (from the name)	before 1.4.13	CNA record
DrayTek Corporation VigorAP 912C draytek:vigorap_912c (from the name)	before 1.4.15	CNA record
DrayTek Corporation VigorAP 903 draytek:vigorap_903 (from the name)	before 1.4.22	CNA record

References

References

https://www.draytek.com/about/security-advisory/multiple-remote-code-execution-and-buffer-overflow-vulnerabilities-in-vigorap-series-august-2026/	vendor-advisory
https://www.vulncheck.com/advisories/draytek-vigorap-multiple-models-os-command-injection-via-inquiertime	third-party-advisory

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.