CVE-2026-113397 in Vigor2960
Summary
by MITRE • 10/20/2026
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/20/2026
A critical remote command injection vulnerability has been identified within the IPsec Handler component of DrayTek Vigor2960 routers, specifically affecting firmware version 1.5.1.6 Revision 8218 and potentially earlier versions in the same lineage. The flaw resides in the ruequest_certificate function located within the /cgi-bin/mainfunction.cgi script, which serves as a primary interface for managing IPsec configurations. This component is responsible for handling certificate-based authentication requests essential for establishing secure virtual private network tunnels. Due to insufficient input validation and sanitization of the option argument passed to this function, an attacker can inject arbitrary operating system commands that are executed with the privileges of the web server process running on the device.
The technical nature of this vulnerability aligns closely with CWE-78 Improper Neutralization of Special Elements used in an OS Command, commonly known as command injection. The root cause lies in the failure to properly escape or filter special characters such as semicolons, ampersands, and pipes within user-supplied input before it is concatenated into system-level shell commands. This allows a malicious actor to break out of the intended context of the certificate request processing and execute arbitrary code on the underlying operating system. Because this functionality is exposed via an HTTP-based CGI interface, the vulnerability can be exploited remotely over the network without requiring prior authentication if the web management interface is accessible from untrusted networks or if default credentials are still in use.
The operational impact of this vulnerability is severe, as successful exploitation grants an attacker full control over the affected router. This level of access enables a range of malicious activities including pivoting into internal corporate networks, intercepting sensitive traffic intended for IPsec tunnels, installing persistent backdoors, and using the compromised device as a launchpad for further attacks against other assets on the local network segment. The severity is compounded by the fact that public exploits have been disclosed, lowering the barrier to entry for opportunistic attackers who may scan for vulnerable devices across the internet. This scenario reflects common attack patterns found in MITRE ATT&CK frameworks related to initial access and execution via web applications or remote services.
Mitigation strategies must prioritize immediate remediation despite the vendor's statement regarding end-of-life status. The primary recommendation is to upgrade the firmware to version 1.5.1.7, which addresses this specific command injection flaw along with other security issues identified in previous releases. However, given that DrayTek has declared the Vigor2960 series as End of Support with limited review for only major unauthenticated vulnerabilities, long-term resilience requires more robust architectural changes. Organizations should consider replacing these devices with supported models that receive regular security patches and updates. In environments where immediate replacement is not feasible, network segmentation strategies must be employed to restrict access to the management interface from untrusted zones. Additionally, implementing strict input validation at the application layer or using a web application firewall can provide an additional layer of defense against exploitation attempts while planning for hardware refresh cycles.