CVE-2026-71914

Name of the Vulnerable Software and Affected Versions DrayTek VigorAP (affected versions not specified)

Description A command injection issue exists in the dray apm component. The flaw stems from insufficient validation of UDP message content following a START SPEED TEST request before the system executes commands. A remote attacker can exploit this by sending a specially crafted message to execute arbitrary commands with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.