CVE-2026-113390 is a critical-rated OS command injection flaw in the CGI interface of the end-of-support DrayTek Vigor2960, and a public exploit is available.
What Is It
The flaw is in the sub_182B0 function of /cgi-bin/mainfunction.cgi, part of the Vigor2960's CGI Interface component. Attackers can manipulate the usefile, usescript or option arguments to cause OS command injection. NVD maps the issue to CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB is the CNA and reported the flaw. NVD published the record on 2026-10-20 with a status of "Received," which means NVD has not analyzed it yet.
The researcher write-up linked from the record is case DRV2960-0007 in the yikesoftware DrayTek Vigor2960 Security Analysis repository. Its title, "authenticated jsonstatus usefile file clobber," describes an authenticated file overwrite through the usefile parameter, not command injection. Because the CVE record and the linked case describe the issue differently, readers should check both before deciding on its impact.
Why It Matters
- Severity: The CNA rates it CVSS 3.1 9.9 CRITICAL (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), CVSS 4.0 8.6 HIGH, and CVSS 2.0 9.0 HIGH. - Remote attack with low barriers: It can be exploited over the network with low attack complexity and no user interaction. Low-level privileges are required, so the attacker needs some authenticated access.
- Scope change: The CVSS 3.1 scope is "Changed" and confidentiality, integrity and availability impacts are all High. A successful attack could affect resources beyond the vulnerable component.
- Public exploit: The description says "the exploit has been published and may be used," and CVSS 4.0 rates exploit maturity as Proof-of-Concept.
- KEV status: CVE-2026-113390 has no CISA KEV entry at this time. Active exploitation in the wild is not confirmed by KEV.
What's Vulnerable
- Vendor/Product: DrayTek Vigor2960
- Affected version: 1.5.1.6 Revision 8218
- Component: CGI Interface (
/cgi-bin/mainfunction.cgi) - CPE:
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
The CVE is tagged unsupported-when-assigned. According to the record, the vulnerability "only affects products that are no longer supported by the maintainer."
Patch Status
The source data does not list a dedicated fix. DrayTek is quoted as saying: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed (e.g. unauthenticated vuln.)" The record does not confirm that 1.5.1.7 fixes this specific CVE.
Because there is no KEV entry, CISA has issued no required action or due date. Organizations still running Vigor2960 devices should keep in mind that the product is end-of-support and that the vendor reviews only major issues.