---
id: "CVE-2026-113389"
kind: "vulnerability"
aliases: ["CVE-2026-113389"]
title: "DrayTek Vigor2960 router: command injection via web management CGI"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Vigor2960", "fixed": [], "affected": "1.5.1.6 Revision 8218 (other versions unknown)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["command-injection", "draytek", "end-of-support", "infrastructure", "routers", "self-hosted", "vigor2960"]
not_affected_if: ["default-config", "wan-management-disabled"]
published_at: "2026-10-20T12:17:29+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-23T23:21:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113389", "first_seen_at": "2026-10-23T21:57:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:21:15+00:00"}]
---

# DrayTek Vigor2960 router: command injection via web management CGI

Authenticated (low-privilege) command injection in set_table of /cgi-bin/mainfunction.cgi on the end-of-support DrayTek Vigor2960 (firmware 1.5.1.6 Rev 8218). The sectiontype argument reaches an OS command. A PoC is public. DrayTek has published no advisory for it and says it will only review major issues such as unauthenticated ones.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Vigor2960 affected 1.5.1.6 Revision 8218 (other versions unknown) fixed ?

## How to check

Log in to the router web UI and open System Status to read the model and firmware. Vigor2960 on 1.5.1.6 (Revision 8218) is confirmed affected. Other versions are unknown. Check whether HTTP/HTTPS management is reachable from the WAN (System Maintenance > Management, and any access list). Check for unknown or shared admin or low-privilege accounts.

## Fix

No confirmed fix. DrayTek says 1.5.1.7 corrected many security issues but has not said it fixes this one. Move to 1.5.1.7 as a minimum. Disable WAN-side web management, or allow it only from trusted IPs or over VPN. Audit and rotate router accounts. Plan to replace the router, since the model is EoS.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113389
- 2026-10-23T23:21:15+00:00 analyst — Read VulDB VDB-422665 (submit #992223 by eqqie: 'Authenticated set_table JSONData Command Injection') and Lekkenradar. Exploit needs a low-privilege login (CVSS PR:L), not unauthenticated. PoC is on GitHub per VulDB but I did not find the link. No DrayTek advisory, and no exploitation reported. 1.5.1.7 is not confirmed as a fix for this CVE. Sibling CVE-2026-113390 and CVE-2026-113394 are from the same disclosure batch.

## Documents

- [advisory] VulDB VDB-422665: Vigor2960 set_table sectiontype command injection https://vuldb.com/vuln/422665
- [describes] DrayTek Vigor2960: 8 lekken in firmware 1.5.1.6 https://lekkenradar.nl/draytek-vigor2960-lekken-firmware-1-5-1-6-oktober-2026/

## From the sources

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_