CVE-2026-113391: DrayTek Vigor2960: Command injection via firmware upload function

Summary

DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) contains a command injection flaw in the uploadlangs function of /cgi-bin/mainfunction.cgi. An attacker with a valid login with low privileges (PR:L) can send a crafted file name and execute arbitrary operating system commands on the device. The CVSS vector indicates network reachability, so a management interface exposed to the internet makes the risk considerably higher. The Vigor2960 is end-of-support, so further fixes are not guaranteed.

Affected

DrayTek Vigor2960, firmware 1.5.1.6 Revision 8218

Fixed in

Firmware 1.5.1.7 (according to the CNA data and the vendor download location)

Workaround

No official workaround known.
Until the firmware is updated: close web management on the WAN side, restrict admin access to LAN or VPN, use strong unique admin passwords and review admin accounts. These are general controls, not vendor-published mitigations.

Exploitation

VulDB rates the exploit as present and the status as proof-of-concept. A public PoC repository is referenced.
CISA SSVC assessment: exploitation poc, not automatable.
No evidence of in-the-wild exploitation found. Not listed in KEV according to OpenCVE.

Our recommendation

Inventory all Vigor2960 devices and firmware versions, including branch sites.
Upgrade to 1.5.1.7 where possible; plan replacement for devices that cannot be upgraded.
Close WAN-side management and restrict admin access to LAN or VPN.
Enforce strong unique admin passwords and review admin accounts.
Check logs for unexpected admin logins or unusual mainfunction.cgi requests.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

VulDB CVE-2026-113391 vuldb.com
VulDB entry 422667 vuldb.com
Firmware Vigor2960 v1.5.1.7 download fw.draytek.com.tw
GitHub PoC case DRV2960-0008 github.com
DrayTek security advisory index www.draytek.com
OpenCVE CVE-2026-113391 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:37.

Original description (NVD)

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed