An authenticated command injection flaw in the CGI interface of DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 scores CVSS 9.9. A public exploit is now available, and the vendor no longer fully supports the product.
What Is It
CVE-2026-113389 is a command injection vulnerability (CWE-77, CWE-74). It sits in the set_table function of /cgi-bin/mainfunction.cgi, which belongs to the device's CGI Process component. An attacker can inject commands by manipulating the sectiontype argument, and can launch the attack remotely. VulDB, acting as CNA, published the record on 2026-10-20. NVD's entry for the CVE lists its status as "Received," which means NVD has not finished its analysis.
Why It Matters
The CNA scores this flaw 9.9 (CRITICAL) under CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and 8.6 (HIGH) under CVSS 4.0. Both ratings say the attack:
- works over the network
- has low complexity
- needs no user interaction
- has a high impact on confidentiality, integrity and availability
The scope is marked as changed, so the impact can reach beyond the vulnerable component.
The attacker needs low-level privileges, and the researcher's write-up calls it an authenticated issue. The record says the exploit is public and may be used. CVSS 4.0 rates exploit maturity as Proof-of-Concept.
The supplied data contains no CISA KEV entry for this CVE, so KEV does not confirm active exploitation at this time.
What's Vulnerable
- Vendor: DrayTek
- Product: Vigor2960
- Affected version: 1.5.1.6 Revision 8218
- Component: CGI Process (
/cgi-bin/mainfunction.cgi,set_table) - CPE:
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
The CNA tagged the record "unsupported-when-assigned," and the record says the vulnerability only affects products the maintainer no longer supports.
Patch Status
The record does not name a patch for this CVE. The vendor said: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed (e.g. unauthenticated vuln.)" The vendor's statement does not say whether 1.5.1.7 fixes this flaw. Because the flaw requires authentication, it may also fall outside the vendor's limited review scope.
The supplied data contains no KEV required action. Organizations still running Vigor2960 1.5.1.6 should consider these steps:
- Consider moving to firmware 1.5.1.7, which the vendor says corrects many security issues. It has not been confirmed to fix CVE-2026-113389, so don't rely on it as the only mitigation.
- Limit who can reach the management interface.
- Review which accounts have access to the device.
- Plan to replace the end-of-support device.