CVE-2026-113389 in Vigor2960
Summary
by MITRE • 10/20/2026
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/20/2026
The DrayTek Vigor2960 router, specifically running firmware version 1.5.1.6 Revision 8218, contains a critical security flaw within its Common Gateway Interface process. This vulnerability resides in the set_table function located in the /cgi-bin/mainfunction.cgi script file. The core technical issue is an improper neutralization of special elements used in an operating system command, which classifies this as CWE-78: Improper Neutralization of Special Elements used in an OS Command. An attacker can exploit this flaw by manipulating the sectiontype argument passed to the CGI process. Because the input validation and sanitization mechanisms are insufficient, maliciously crafted data inserted into this parameter is executed directly by the underlying operating system shell rather than being treated as a simple string value for table configuration.
This command injection vulnerability allows for remote code execution without requiring any form of authentication or user interaction prior to exploitation. The attack vector is classified under Remote Code Execution (RCE) and falls within the ATT&CK technique T1059: Command and Scripting Interpreter, specifically involving OS-level commands executed via a web service interface. Since the CGI process typically runs with elevated privileges necessary for router configuration management, successful exploitation grants an attacker full control over the device's operating system. This level of access enables the adversary to perform arbitrary actions such as installing persistent backdoors, exfiltrating sensitive network data, pivoting into internal networks, or disrupting service availability by modifying routing tables and firewall rules.
The operational impact is severe due to the nature of router devices acting as gateways between trusted internal networks and untrusted external networks like the internet. Compromise of this device effectively neutralizes perimeter security controls managed by the router itself. Attackers can redirect traffic, intercept communications, or use the compromised device as a launchpad for further attacks against other assets on the local network segment. The fact that an exploit is publicly available significantly lowers the barrier to entry for threat actors, increasing the likelihood of automated scanning and exploitation campaigns targeting vulnerable instances across the internet.
Vendor documentation indicates that firmware version 1.5.1.7 addresses many security issues including this specific vulnerability. However, a critical constraint exists regarding support status: the Vigor2960 model is End-of-Service (EoS) with limited support availability. The vendor has stated that only major issues such as unauthenticated vulnerabilities would be reviewed for patching in future updates. Given that EoS products typically cease receiving regular security patches, organizations relying on this hardware face a high risk profile where known exploits remain viable indefinitely unless mitigated through other means.
Mitigation strategies must account for the lack of ongoing vendor support. The most effective technical control is network segmentation to isolate vulnerable devices from critical internal resources and restrict their exposure to untrusted networks using firewall rules that block direct access to the CGI endpoints or limit them to trusted management IP addresses only. If possible, replacing the EoS hardware with a supported model providing regular security updates is strongly recommended. For environments where immediate replacement is not feasible, implementing strict input validation at the network perimeter and monitoring for anomalous outbound connections from the router can help detect exploitation attempts. Additionally, disabling unnecessary CGI services or restricting access to administrative interfaces via IP whitelisting reduces the attack surface available to remote attackers attempting to leverage this command injection flaw.