NCSC-2026-0327 [1.00] [M/H] Vulnerabilities patched in DrayTek VigorAP

unknownCVE-2026-71904 CVE-2026-71905 CVE-2026-71906 CVE-2026-71907 CVE-2026-71908 CVE-2026-71909

DrayTek has patched multiple vulnerabilities in the VigorAP product line. The vulnerabilities are located in various functions and components of the DrayTek VigorAP devices, including tr069TestInform, ExportSettings, setLan, setcamset, mesh_start_speed_test, InquierTime, apautotest, upload_settings.cgi and dray_apm. These vulnerabilities make it possible for attackers with valid authentication to execute arbitrary commands with root privileges through insufficient input validation and filtering. Additionally, there are buffer overflow vulnerabilities in the setLan and apautotest functions, where sending specially crafted input can cause denial of service or execute arbitrary code. Exploitation of these vulnerabilities can lead to complete system compromise within the context of the root user. The vulnerabilities are specifically applicable to multiple models within the DrayTek VigorAP product line.

CSIRTS triage

vendor: DrayTek product: VigorAP Remote code execution Code injection Memory corruption Denial of service

What: Multiple vulnerabilities in VigorAP devices allow authenticated attackers to execute arbitrary commands with root privileges, and buffer overflows can cause denial-of-service or code execution.
Who is affected: VigorAP devices where authenticated users can reach vulnerable functions, or where buffer overflow attacks can be triggered.
Urgency: High priority; root-level arbitrary code execution enables complete device compromise.
Action: Apply DrayTek firmware patches addressing CVE-2026-71904 through CVE-2026-71911 to all affected VigorAP models.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch VigorAP

Get an email when a new VigorAP advisory drops — max one per day, one-click unsubscribe.

Details

Source: NCSC-NL Advisories (NL · national-cert · site)
Severity: unknown
Published: 2026-08-26
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0327

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2026-719042.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719053.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719063.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719073.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719083.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719093.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719103.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-719110.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Low exploitation riskCVE-2026-719120.48% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 39% of all EPSS-scored CVEs.
Moderate exploitation riskCVE-2026-719132.4% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 83% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-71904	coverage & exploitation status	NVD · CVE.org
CVE-2026-71905	coverage & exploitation status	NVD · CVE.org
CVE-2026-71906	coverage & exploitation status	NVD · CVE.org
CVE-2026-71907	coverage & exploitation status	NVD · CVE.org
CVE-2026-71908	coverage & exploitation status	NVD · CVE.org
CVE-2026-71909	coverage & exploitation status	NVD · CVE.org
CVE-2026-71910	coverage & exploitation status	NVD · CVE.org
CVE-2026-71911	coverage & exploitation status	NVD · CVE.org
CVE-2026-71912	coverage & exploitation status	NVD · CVE.org
CVE-2026-71913	coverage & exploitation status	NVD · CVE.org
CVE-2026-71914	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for DrayTek VigorAP

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

medium[NEW] [medium] DrayTek VigorAP: Multiple Vulnerabilities Enable Code Executioncert-bund · 2026-08-25
criticalCVE-2026-71914: Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm comp…nvd · 2026-08-24
highCVE-2026-71913: Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settin…nvd · 2026-08-24
highCVE-2026-71912: Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest func…nvd · 2026-08-24
highCVE-2026-71911: Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function…nvd · 2026-08-24
highCVE-2026-71910: Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest fu…nvd · 2026-08-24