CVE-2026-113390 in Vigor2960
Summary
by MITRE • 10/20/2026
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The DrayTek Vigor2960 router, specifically version 1.5.1.6 Revision 8218, contains a critical security flaw within its Common Gateway Interface implementation. The vulnerability resides in the sub_182B0 function located in the /cgi-bin/mainfunction.cgi file. This component is responsible for handling various administrative and configuration requests from users or remote attackers interacting with the device's web management interface. The specific technical failure involves improper neutralization of special elements used in an operating system command, commonly known as OS Command Injection. By manipulating arguments such as usefile, usescript, or option passed to this CGI script, an attacker can inject arbitrary commands that are executed by the underlying operating system with the privileges of the web server process. This represents a classic CWE-78 vulnerability where user-supplied input is not adequately sanitized before being concatenated into shell commands.
The operational impact of this flaw is severe due to its remote exploitable nature and lack of authentication requirements in certain contexts or through specific vector combinations that bypass standard access controls. An unauthenticated attacker can leverage this weakness to execute arbitrary system commands on the router's firmware. This capability effectively grants full control over the device, allowing for complete compromise of network integrity. The attacker could potentially pivot from the compromised router into the internal network, intercept sensitive traffic, modify routing tables, or deploy persistent malware such as botnet agents like Mirai variants which frequently target IoT devices with similar vulnerabilities. Given that DrayTek has classified this product line as End-of-Life with limited support, only major issues affecting unauthenticated access are reviewed, meaning no further patches will be issued for version 1.5.1.6 or earlier revisions.
From a threat intelligence perspective, the existence of published exploits significantly lowers the barrier to entry for malicious actors. This aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically shell commands executed via web application interfaces. The availability of proof-of-concept code means that automated scanning tools and opportunistic attackers can easily identify and exploit vulnerable devices across the internet without needing specialized knowledge or custom tool development. The situation is exacerbated by the vendor's stance on support lifecycle; while version 1.5.1.7 addresses many security issues, users remaining on older versions are left exposed to known exploits with no official remediation path from the manufacturer other than upgrading hardware if possible.
Mitigation strategies for organizations still operating affected devices must focus on network-level controls since software patches are unavailable. Implementing strict firewall rules to restrict access to the management interface of these routers is essential, limiting exposure only to trusted IP addresses or administrative subnets. Additionally, disabling unused services and features can reduce the attack surface. For long-term resolution, migrating to supported hardware models that receive regular security updates from DrayTek or alternative vendors is strongly recommended. Organizations should also monitor for indicators of compromise associated with known exploits targeting this specific CGI endpoint and ensure their intrusion detection systems are updated to flag attempts to inject shell metacharacters into web requests directed at these devices.