CVE-2026-113391 is a critical (CVSS 3.1: 9.9) command injection flaw in the upload endpoint of DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218. A public exploit is available.
What Is It
The flaw is in the uploadlangs function of /cgi-bin/mainfunction.cgi, part of the device's Upload Endpoint component. Manipulating input to this function leads to command injection. The weaknesses are listed as CWE-74 (Injection) and CWE-77 (Command Injection).
An attacker can launch the attack remotely over the network. It needs low privileges and no user interaction. This matches the published reference, which describes it as an authenticated upload-filename command injection. VulDB, the CNA, scored it as follows:
- CVSS 3.1: 9.9 Critical (
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.6 High, exploit maturity Proof of Concept
- CVSS 2.0: 9.0
Why It Matters
The CNA says the exploit has been disclosed publicly and may be used. The scope is changed and the impact to confidentiality, integrity and availability is high. An attacker with low-privilege access could compromise the device and reach beyond it.
This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation in the wild is not confirmed.
The vulnerability was tagged "unsupported-when-assigned," which means the record says it only affects products the maintainer no longer supports. Organizations still running this hardware should not count on ongoing vendor fixes.
What's Vulnerable
- Vendor: DrayTek
- Product: Vigor2960
- Component: Upload Endpoint (
/cgi-bin/mainfunction.cgi, functionuploadlangs) - Affected: firmware 1.5.1.6 Revision 8218
- Listed as unaffected by the CNA: firmware 1.5.1.7 (not independently confirmed)
- CPE:
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
The NVD record status is "Received," so NVD has not yet finished its analysis. That includes confirming the affected version range.
Patch Status
The CNA recommends upgrading the affected component and lists firmware 1.5.1.7 as unaffected. DrayTek says version 1.5.1.7 "has corrected many security issues." It does not specifically confirm a fix for CVE-2026-113391. Until NVD analysis or a vendor advisory confirms it, treat 1.5.1.7 as a likely fix rather than a verified one. The firmware is available from DrayTek's download server (linked below).
Because the product is tagged as unsupported, owners should apply 1.5.1.7 now and plan to replace the hardware. In the meantime, restrict access to the management interface and limit who holds device credentials. CISA has issued no KEV required action or due date because the CVE is not in the catalog.