CVE-2026-113396
HighCVSS 7.4Summary
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the rename_table function in /cgi-bin/mainfunction.cgi (Rename Table Handler component) mishandles the newtable argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
Risk Assessment
A remote attacker can execute arbitrary commands on the edge device, potentially leading to full compromise of the router and network traffic.
Recommendation
Upgrade to version 1.5.1.7, which fixes this issue. Since the product is EoS, consider migrating to a supported device.
Other vulnerabilities in DrayTek Vigor2960
See all- CVE-2026-113397High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler component) mishandles the option argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113395High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the cgiEscape function in /cgi-bin/mainfunction.cgi (swmconfigupload component) mishandles the multipart argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113394High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the setSWMProfile function in /cgi-bin/mainfunction.cgi mishandles the setSWMProfile argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113393Medium
DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-113392High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.
- CVE-2026-113391Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.
- CVE-2026-113390Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.
- CVE-2026-113389Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.
Original NVD description (English source)
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS