CVE-2026-129452

DrayTek Vigor2960 mainfunction.cgi set_table command injection

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Description
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function set_table of the file /cgi-bin/mainfunction.cgi. Such manipulation of the argument jsondata leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Analysis

AI-generated

Technical impact

The vulnerability allows an attacker to inject operating‑system commands through the set_table function in /cgi-bin/mainfunction.cgi by manipulating the jsondata argument. This results in Remote Command Execution, giving the attacker full control over the router’s operating system, compromised confidentiality, integrity, and availability of the device.

Affected Systems

DrayTek Vigor2960 routers running firmware version 1.5.1.6 are affected. The vendor’s 1.5.1.7 release contains a fix that removes the vulnerable code path.

Risk and Exploitability

The CVSS score of 9.4 places this flaw in the Critical range. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, but the public disclosure and evidence of exploitation indicate that remote attackers can launch the attack by sending crafted JSON payloads to the vulnerable endpoint.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router firmware to version 1.5.1.7.
  • Restrict external access to the router’s management interface, e.g., by firewalling or restricting to a trusted subnet.
  • Validate and sanitize the jsondata input before it is passed to any system command to eliminate command‑injection vectors.

Generated by OpenCVE AI on November 15, 2026 at 13:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960
Type Values Removed Values Added
Description A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function set_table of the file /cgi-bin/mainfunction.cgi. Such manipulation of the argument jsondata leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Title DrayTek Vigor2960 mainfunction.cgi set_table command injection
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 8.3, 'vector': 'AV:N/AC:L/Au:M/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.1, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 12:30 PM
Reserved
Nov 14, 2026, 6:12 PM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 1:16 PM
Modified
Nov 15, 2026, 1:16 PM

View source JSON

No data.

Updated
Nov 15, 2026, 1:45 PM

JSON