EUVD-2026-64973

Multiple DrayTek VigorAP models contain a command injection vulnerability in the drayapm component. The vulnerability is caused by insufficient validation of UDP message content after STARTSPEEDTEST before command execution. A remote attacker can trigger this vulnerability via a crafted message t...

CVE-2026-71914

Multiple DrayTek VigorAP models are affected by a pre-authentication OS command injection in the dray_apm component. The root cause is insufficient validation of UDP message content following the START_SPEED_TEST event before command execution, allowing a remote unauthenticated attacker to send a...