DrayTek Vigor2960: Command injection in mainfunction.cgi (authenticated)
Summary
A command injection flaw in the set_table function of the web CGI process (/cgi-bin/mainfunction.cgi) of the DrayTek Vigor2960 router allows an attacker to run arbitrary shell commands on the device. The attacker needs a valid administrator session, and the flaw is reachable remotely if the web management interface is exposed. A public proof-of-concept exists. DrayTek has classed the Vigor2960 as end-of-support with limited support, so this flaw may not receive a fix.
Affected
- DrayTek Vigor2960, firmware 1.5.1.6 Revision 8218
- Other firmware versions: Unknown.
Fixed in
- Firmware 1.5.1.7 or later, according to the vendor statement quoted in the CVE description. This fix was not confirmed on the DrayTek website.
- The vendor reviews only major issues for this end-of-support model, so a fix for this flaw is not guaranteed.
Workaround
- No CVE-specific workaround is known.
- Disable remote management and keep the web admin interface and WAN management away from the internet.
- Restrict access to the device to trusted networks and administrators.
Exploitation
- Public proof-of-concept exploit code exists (VulDB status: Proof-of-Concept).
- Requires an authenticated administrator session.
- No known exploitation in the wild according to the sources reviewed. Not listed in CISA KEV in the sources reviewed.
Our recommendation
- Identify all Vigor2960 devices in your environment and check whether the admin interface is reachable from the internet.
- Restrict management access now and use strong, unique administrator passwords.
- Upgrade to firmware 1.5.1.7 if the device supports it, or plan a replacement, since the model is end-of-support.
- Monitor the device for unexpected configuration changes and review related DrayTek CVEs in the same batch, such as CVE-2026-113391 and CVE-2026-113396.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub: DRV2960-0006 authenticated set_table command injection (case README) github.com
- VulDB: CVE-2026-113389 vulnerability entry vuldb.com
- VulDB: CVE-2026-113389 CTI vuldb.com
- Vulners: CVE-2026-113389 CNA record vulners.com
- OpenCVE: CVE-2026-113389 app.opencve.io
- DrayTek security advisory index www.draytek.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:38.
Original description (NVD)
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.