CVE-2026-113389
9.9CriticalPublished 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-74, CWE-77
Impact
Authenticated remote attackers can execute arbitrary commands on the router with high privileges. Exploitation requires network access to the web interface and low-privileged credentials.
Root cause
Improper sanitization of the sectiontype parameter passed to the set_table function in /cgi-bin/mainfunction.cgi leads to OS command injection.
Affected systems
DrayTek Vigor2960 version 1.5.1.6 Revision 8218 (end-of-support product).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade to firmware version 1.5.1.7 if available; otherwise, disable remote web management and isolate the administration interface to a trusted internal network segment since the device is end-of-support.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.