CVE-2026-113391

9.9Critical

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.9Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-74, CWE-77

Impact

Authenticated remote attackers can execute arbitrary commands on the router with full control over the device. They require low-privilege network access to reach the web interface and an authenticated session.

Root cause

Improper sanitization of input passed to the uploadlangs function in /cgi-bin/mainfunction.cgi enables command injection.

Affected systems

DrayTek Vigor2960 version 1.5.1.6 Revision 8218

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade firmware to version 1.5.1.7. If patching immediately is not possible, restrict access to the web management interface to trusted IP addresses only.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113391