GCVE-110-NCSC-2026-327

Advisory PublishedCVSS 9.8/10

Vulnetix · Advisory published August 26, 2026

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function that permits remote attackers with valid admin credentials to execute arbitrary commands with root privileges due to insufficient input filtering.

Download JSON Open in Console

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Risk Scores

CVSS 3.1

9.8/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Draytek	vers:unknown/*	—	—
DrayTek	vers:unknown/*	—	—

Aliases

CVE-2026-71904 CVE-2026-71905 CVE-2026-71906 CVE-2026-71907 CVE-2026-71908 CVE-2026-71909 CVE-2026-71910 CVE-2026-71911 CVE-2026-71912 CVE-2026-71913 CVE-2026-71914

References

advisory

Browse GCVE Records

867 records in the GCVE database · Updated September 2, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON