DrayTek Corporation Vigorap 906 vulnerabilities

11 CVEs affecting DrayTek Corporation Vigorap 906, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-71914, published 2026-08-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-71914, published 2026-08-24. Critical severity, CVSS 9.8. EPSS: 2.6% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the dray_apm component. The vulnerability is caused by insufficient validation of UDP message content after…
CVE-2026-71910, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before…
CVE-2026-71909, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command…
CVE-2026-71908, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and…
CVE-2026-71907, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command…
CVE-2026-71906, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before…
CVE-2026-71905, published 2026-08-24. High severity, CVSS 7.2. EPSS: 2.3% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the ExportSettings function. The vulnerability is caused by insufficient filtering of the backupkey, backuptype, and…
CVE-2026-71913, published 2026-08-24. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload_settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is…
CVE-2026-71904, published 2026-08-24. High severity, CVSS 7.2. EPSS: 1.8% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the…
CVE-2026-71912, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the…

Latest

CVE-2026-71911, published 2026-08-24. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the setLan function. The vulnerability is caused by missing length checks during memory copy operations involving the…