CVE-2026-113393
MediumCVSS 6.3Summary
DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.
Risk Assessment
An attacker could upload malicious files to the device, potentially leading to code execution or device compromise.
Recommendation
Update DrayTek Vigor2960 firmware to version 1.5.1.7 or later. Note that the product is EoS with limited support.
Other vulnerabilities in DrayTek Vigor2960
See all- CVE-2026-113397High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler component) mishandles the option argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113396High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the rename_table function in /cgi-bin/mainfunction.cgi (Rename Table Handler component) mishandles the newtable argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113395High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the cgiEscape function in /cgi-bin/mainfunction.cgi (swmconfigupload component) mishandles the multipart argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113394High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the setSWMProfile function in /cgi-bin/mainfunction.cgi mishandles the setSWMProfile argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113392High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.
- CVE-2026-113391Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.
- CVE-2026-113390Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.
- CVE-2026-113389Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.
Original NVD description (English source)
A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS