CVE-2026-113396 in Vigor2960
Summary
by MITRE • 10/20/2026
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The identified vulnerability resides within the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218, specifically affecting the Rename Table Handler component located in the file /cgi-bin/mainfunction.cgi. The core technical flaw is a command injection weakness triggered by improper validation of user-supplied input passed to the rename_table function via the newtable argument. This type of vulnerability falls under CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. When the application processes this parameter without adequate sanitization or escaping, it allows attackers to inject arbitrary operating system commands that are executed with the privileges of the web server process running on the device. This represents a critical failure in input validation and output encoding practices within the embedded Linux environment hosting the router's management interface.
The operational impact of this vulnerability is severe due to its remote nature and lack of authentication requirements for exploitation. Attackers can initiate the attack remotely over network connections, potentially including the internet if port forwarding or NAT rules expose the administrative interface. Since the exploit has been made publicly available in the wild, automated scanning tools and malicious actors actively target devices running this specific firmware version. Successful exploitation grants an attacker full command-line access to the underlying operating system of the router. This level of compromise allows for complete control over the network infrastructure, enabling activities such as traffic interception, DNS spoofing, installation of persistent backdoors, pivoting into internal networks, and denial-of-service attacks against connected devices or upstream providers. The availability of public exploits significantly lowers the barrier to entry for attackers, increasing the likelihood of widespread automated compromise across vulnerable deployments.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Command and Scripting Interpretation (T1059) and potentially Remote Services such as SSH or Web Service depending on how the injected commands are leveraged for persistence or lateral movement. The presence of public exploits places these devices at high risk within threat landscapes that target Internet-of-Things endpoints, particularly those used in small to medium-sized businesses where network segmentation may be less rigorous than in enterprise environments. The ability to execute arbitrary code remotely without authentication classifies this as a critical severity issue under standard vulnerability scoring systems like CVSS due to its wide attack vector and high impact on confidentiality, integrity, and availability.
Mitigation strategies primarily focus on immediate remediation through firmware updates. DrayTek has released version 1.5.1.7 which corrects these security issues by implementing proper input validation for the rename_table function and other related components within the CGI handler. Administrators should upgrade to this patched version as soon as possible to eliminate the attack surface. However, it is crucial to note that DrayTek has declared the Vigor2960 series End of Support with limited support availability. The vendor indicates that only major issues such as unauthenticated vulnerabilities would be reviewed in future updates, implying a reduced long-term security posture for this hardware line. Consequently, organizations relying on these devices should consider them compromised until patched and plan for eventual replacement with supported models to ensure ongoing protection against emerging threats. Network-level mitigations such as restricting access to the management interface via IP whitelisting or placing it behind an authenticated reverse proxy can provide temporary defense-in-depth measures while migration plans are executed, though they do not replace the need for patching the underlying software flaw.