Description
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-20
Score: 5.3 Medium
EPSS: 1.0% Low
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability arises from improper handling of the option parameter in the ruequest_certificate function, allowing an attacker to inject shell commands through the /cgi-bin/mainfunction.cgi interface. When triggered remotely, this command injection can enable the execution of arbitrary commands on the router, potentially leading to full device takeover, exfiltration of configuration data, or installation of malicious firmware.

Affected Systems

Affected are DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218. Firmware 1.5.1.7 contains the fix and no longer includes the vulnerable implementation. Note that the base product is end‑of‑support, so the vendor provides mitigation only for the most severe issues.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is 1% while the vulnerability is not listed in the CISA KEV catalog. Because the attack can be launched remotely without any explicit authentication requirement as described, the risk of exploitation remains present for devices exposed to untrusted networks.

Generated by OpenCVE AI on October 22, 2026 at 20:10 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device to firmware version 1.5.1.7, which removes the vulnerable code.
  • If remote IPsec management is not required, disable or restrict it to trusted internal networks.
  • Ensure that the router’s public interfaces are protected by a firewall or NAT to limit exposure to external hosts.

Generated by OpenCVE AI on October 22, 2026 at 20:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Title DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}

Subscriptions

Draytek Vigor2960 Vigor2960 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-20T15:26:34.813Z

Reserved: 2026-10-20T05:50:37.712Z

Link: CVE-2026-113397

cve-icon Vulnrichment

Updated: 2026-10-20T15:26:30.067Z

cve-icon NVD

Status : Deferred

Published: 2026-10-20T15:17:18.337

Modified: 2026-10-20T19:27:34.430

Link: CVE-2026-113397

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T20:15:09Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')