CVE-2026-71913

Multiple DrayTek VigorAP models are affected by an OS command injection vulnerability in the upload_settings.cgi interface. The root cause is insufficient filtering of the restorekey field before it is concatenated into a shell command, allowing a remote attacker with valid administrative credent...

EUVD-2026-64972

Multiple DrayTek VigorAP models contain a command injection vulnerability in the uploadsettings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted input...