{"id":"CVE-2026-113389","kind":"vulnerability","aliases":["CVE-2026-113389"],"related":[],"title":"DrayTek Vigor2960 router: command injection via web management CGI","description":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","summary":"Authenticated (low-privilege) command injection in set_table of /cgi-bin/mainfunction.cgi on the end-of-support DrayTek Vigor2960 (firmware 1.5.1.6 Rev 8218). The sectiontype argument reaches an OS command. A PoC is public. DrayTek has published no advisory for it and says it will only review major issues such as unauthenticated ones.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vigor2960","fixed":[],"affected":"1.5.1.6 Revision 8218 (other versions unknown)","ecosystem":"vendor"}],"ecosystems":[],"tags":["command-injection","draytek","end-of-support","infrastructure","routers","self-hosted","vigor2960"],"not_affected_if":["default-config","wan-management-disabled"],"how_to_check":"Log in to the router web UI and open System Status to read the model and firmware. Vigor2960 on 1.5.1.6 (Revision 8218) is confirmed affected. Other versions are unknown. Check whether HTTP/HTTPS management is reachable from the WAN (System Maintenance > Management, and any access list). Check for unknown or shared admin or low-privilege accounts.","fix":"No confirmed fix. DrayTek says 1.5.1.7 corrected many security issues but has not said it fixes this one. Move to 1.5.1.7 as a minimum. Disable WAN-side web management, or allow it only from trusted IPs or over VPN. Audit and rotate router accounts. Plan to replace the router, since the model is EoS.","status":"open","published_at":"2026-10-20T12:17:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:33+00:00","updated_at":"2026-10-23T23:21:15+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-23T22:39:33Z","model":"claude-haiku-5-5","output":{"fix":"Move to a supported firmware release (the vendor says 1.5.1.7 fixed many issues, but this model is end of support); if no fix is available, restrict access to the web management interface.","reach":"internet","title":"DrayTek Vigor2960 router: command injection via web management CGI","impact":"high","summary":"The set_table function in the router's /cgi-bin/mainfunction.cgi trusts the sectiontype parameter, so a remote request can inject operating system commands. A public exploit exists, and the vendor says the flaw is in an end-of-support model that it will not fully review.","category":"infrastructure","who_cares":["draytek","vigor2960","routers","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs commands on the router remotely.","analyst_note":"Confirm whether the web management interface is exposed to WAN and whether authentication is required for mainfunction.cgi; check the DrayTek advisory for the fixed firmware on the EoS model.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000515,"input_tokens":3051,"output_tokens":419,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the web management interface is exposed to WAN and whether authentication is required for mainfunction.cgi; check the DrayTek advisory for the fixed firmware on the EoS model.","search":"'-113389':12A,15A '-2026':11A,14A '/cgi-bin/mainfunction.cgi':41B,106C '1.5.1.6':51B,91C '1.5.1.7':141C '2960':140C,148C '8218':53B,93C 'advisori':69B 'affect':94C,166C 'argument':56B,116C 'attack':123C 'authent':31B 'cgi':9A,110C 'command':4A,18B,35B,60B,120C 'command-inject':17B 'compon':109C 'correct':143C 'cve':10A,13A 'detect':87C 'draytek':1A,20B,48B,65B,89C 'e.g':160C 'end':22B,45B 'end-of-support':21B,44B 'eo':150C 'explain':139C 'exploit':129C 'file':105C 'firmwar':50B 'function':100C 'host':29B 'infrastructur':25B 'inject':5A,19B,36B,121C 'issu':79B,146C,156C 'launch':126C 'limit':152C 'longer':171C 'low':33B 'low-privileg':32B 'maintain':175C 'major':78B,155C 'manag':8A 'mani':144C 'manipul':113C 'may':124C,134C 'one':83B 'os':59B 'poc':62B 'privileg':34B 'process':111C 'product':167C 'public':64B,132C 'publish':67B 'reach':57B 'remot':127C 'result':118C 'rev':52B 'review':77B,159C 'revis':92C 'router':3A,26B 'say':73B 'sectiontyp':55B,117C 'secur':145C 'self':28B 'self-host':27B 'set':38B,101C 'support':24B,47B,153C,172C 'tabl':39B,102C 'unauthent':82B,161C 'use':136C 'vendor':138C 'via':6A 'vigor2960':2A,16A,30B,49B,90C 'vuln':162C 'vulner':85C,97C,164C 'web':7A 'would':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113389","severity":null,"published_at":"2026-10-20T12:17:29+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113389:423","url":null,"severity":null,"published_at":"2026-10-23T23:21:15+00:00","modified_at":"2026-10-23T23:21:15+00:00","first_seen_at":"2026-10-23T23:21:15+00:00","fetched_at":"2026-10-23T23:21:15+00:00","note":"Read VulDB VDB-422665 (submit #992223 by eqqie: 'Authenticated set_table JSONData Command Injection') and Lekkenradar. Exploit needs a low-privilege login (CVSS PR:L), not unauthenticated. PoC is on GitHub per VulDB but I did not find the link. No DrayTek advisory, and no exploitation reported. 1.5.1.7 is not confirmed as a fix for this CVE. Sibling CVE-2026-113390 and CVE-2026-113394 are from the same disclosure batch."}],"documents":[{"id":1902,"url":"https://vuldb.com/vuln/422665","title":"VulDB VDB-422665: Vigor2960 set_table sectiontype command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1903,"url":"https://lekkenradar.nl/draytek-vigor2960-lekken-firmware-1-5-1-6-oktober-2026/","title":"DrayTek Vigor2960: 8 lekken in firmware 1.5.1.6","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}