PT-2026-80947

Multiple DrayTek VigorAP models contain a command injection vulnerability in the upload settings.cgi interface. The vulnerability is caused by insufficient filtering before the restorekey field is concatenated into a shell command. A remote attacker can trigger this vulnerability via crafted inpu...