Description
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-20
Score: 9.4 Critical
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability resides in the uploadlangs operation of the /cgi-bin/mainfunction.cgi script on DrayTek Vigor2960 routers. Malicious actors can supply specially crafted parameters that are invoked directly by the router, allowing arbitrary shell commands to be executed with system privileges. This injection flaw can compromise the confidentiality, integrity, and availability of the device and any connected networks, meeting the definition of command injection (CWE-74, CWE-77).

Affected Systems

The flaw affects the DrayTek Vigor2960 line running firmware version 1.5.1.6 Revision 8218 and earlier. Upgrades to 1.5.1.7 provide a fix, but routers running the older firmware are exposed, and the device is no longer supported for most issues.

Risk and Exploitability

The CVSS base score of 9.4 classifies this as Critical, indicating a severe threat landscape. The EPSS score is not available, but the vulnerability has been publicly disclosed and used in the wild, implying a non‑negligible exploitation probability. The issue is not listed in the CISA KEV catalog, yet the remote nature of the attack path and the lack of authentication in the endpoint raise a high likelihood of successful compromise when the device is exposed to an untrusted network.

Generated by OpenCVE AI on October 20, 2026 at 14:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply firmware 1.5.1.7 to all affected Vigor2960 devices.
  • If the router cannot be upgraded, block or remove access to the /cgi-bin/mainfunction.cgi endpoint using network ACLs or firewall rules.
  • Isolate the router from untrusted networks and enforce a strict internal segmentation policy.
  • Monitor for anomalous command activity and perform regular vulnerability scanning of network devices.

Generated by OpenCVE AI on October 20, 2026 at 14:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Title DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}

Subscriptions

Draytek Vigor2960 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T15:52:14.652Z

Reserved: 2026-10-20T05:50:15.239Z

Link: CVE-2026-113391

cve-icon Vulnrichment

Updated: 2026-10-20T15:52:11.031Z

cve-icon NVD

Status : Received

Published: 2026-10-20T13:16:40.640

Modified: 2026-10-20T16:17:06.940

Link: CVE-2026-113391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T14:45:13Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')