Description
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-20
Score: 9.4 Critical
EPSS: 2.1% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the uploadlangs operation of the /cgi-bin/mainfunction.cgi script on DrayTek Vigor2960 routers. Malicious actors can supply specially crafted parameters that are invoked directly by the router, allowing arbitrary shell commands to be executed with system privileges. This injection flaw can compromise the confidentiality, integrity, and availability of the device and any connected networks, meeting the definition of command injection (CWE-74, CWE-77).

Affected Systems

The flaw affects the DrayTek Vigor2960 line running firmware version 1.5.1.6 Revision 8218 and earlier. Upgrades to 1.5.1.7 provide a fix, but routers running the older firmware are exposed, and the device is no longer supported for most issues.

Risk and Exploitability

The CVSS base score of 9.4 classifies this as Critical, indicating a severe threat landscape. The EPSS score of 2% indicates a very low but nonzero probability of exploitation. The vulnerability has been publicly disclosed, but there is no evidence of active exploitation in the wild. The endpoint is unauthenticated and can be triggered remotely over a network, giving an attacker an opportunity to execute commands on the device if the router is exposed to an untrusted network.

Generated by OpenCVE AI on October 22, 2026 at 20:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply firmware 1.5.1.7 to all affected Vigor2960 devices.
  • If the router cannot be upgraded, block or remove access to the /cgi-bin/mainfunction.cgi endpoint using network ACLs or firewall rules.
  • Isolate the router from untrusted networks and enforce a strict internal segmentation policy.
  • Monitor for anomalous command activity and perform regular vulnerability scanning of network devices.

Generated by OpenCVE AI on October 22, 2026 at 20:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Title DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Draytek Vigor2960 Vigor2960 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T15:52:14.652Z

Reserved: 2026-10-20T05:50:15.239Z

Link: CVE-2026-113391

cve-icon Vulnrichment

Updated: 2026-10-20T15:52:11.031Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T13:16:40.640

Modified: 2026-10-20T19:27:34.430

Link: CVE-2026-113391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:45:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')