The vulnerability resides in the rename_table function of /cgi-bin/mainfunction.cgi on DrayTek Vigor2960, where the newtable argument is improperly incorporated into a shell command, enabling arbitrary command execution. This flaw directly allows an attacker to run shell commands on the router. Based on the nature of command injection, it is inferred that an attacker could compromise the router’s operating system, disrupt network services, or modify configuration data.

The issue is present in DrayTek Vigor2960 routers running firmware version 1.5.1.6 revision 8218. Upgrading to firmware 1.5.1.7 removes the flaw, but the device is end‑of‑support, with the vendor only addressing major critical issues such as unauthenticated vulnerabilities. No other firmware revisions or models are reported to be affected.

The CVSS base score of 5.3 denotes moderate severity, and the EPSS score is 1.5%. The vulnerability is not listed in the CISA KEV catalog. The attack can be initiated remotely, as indicated by the description, and publicly available exploits are known, so the flaw remains exploitable until the firmware is updated.