DrayTek Vigor2960: OS command injection in CGI interface
Summary
An OS command injection flaw in the CGI interface (/cgi-bin/mainfunction.cgi, function sub_182B0) of the end-of-sale DrayTek Vigor2960 router firmware 1.5.1.6 Revision 8218 allows an attacker to run operating system commands. The attacker can send manipulated usefile, usescript and option values, which are inserted unescaped into shell commands. Exploitation requires a valid (low-privilege) session and a reachable web management interface. A successful attack can lead to a root shell and full control of the device.
Affected
- DrayTek Vigor2960, firmware 1.5.1.6 Revision 8218
- Other firmware versions: Unknown.
Fixed in
- Unknown from a verified DrayTek advisory.
- An unverified quote from secondary sources attributes to the vendor that 1.5.1.7 corrects many security issues.
- The vendor states the model is end of sale with limited support and that only major issues are reviewed.
Workaround
- No vendor workaround known.
- Disable WAN access to the web management interface and restrict it to a management VLAN or VPN.
Exploitation
- Public exploit code is referenced by VulDB and a GitHub case repository; sources conflict on whether usable code is public.
- CISA SSVC: exploitation status 'poc', not automatable.
- Not listed in the CISA KEV catalog according to the sources reviewed.
Our recommendation
- Plan replacement with a currently supported router or firewall model.
- Until then, restrict web management to trusted internal networks and disable WAN-side administration.
- Change all admin passwords and remove unnecessary accounts.
- Review logs for unexpected admin logins and unknown configuration or firmware changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulDB entry CVE-2026-113390 vuldb.com
- GitHub research case DRV2960-0007 github.com
- DrayTek product lifecycle www.draytek.com
- DrayTek UK Vigor2960 firmware 1.5.1.1 www.draytek.co.uk
- TheHackerWire CVE-2026-113390 www.thehackerwire.com
- HOL Guard CVE-2026-113390 hol.org
- Vulners CVE-2026-113390 (CVE List) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:36.
Original description (NVD)
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.