{"id":"CVE-2026-113390","kind":"vulnerability","aliases":["CVE-2026-113390"],"related":[],"title":"DrayTek Vigor2960 router: command injection in CGI interface lets remote attackers run commands","description":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","summary":"DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 has an OS command injection in /cgi-bin/mainfunction.cgi (function sub_182B0, arguments usefile/usescript/option). The attacker needs a valid low-privilege login to the web interface (CVSS PR:L). A public proof of concept exists. No exploitation in the wild has been reported. The device is end-of-support.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vigor2960","fixed":[],"affected":"1.5.1.6 Revision 8218","ecosystem":"vendor"}],"ecosystems":[],"tags":["draytek","end-of-support","infrastructure","network-appliance","router","self-hosted","vigor2960"],"not_affected_if":["auth-required","default-config","no-wan-admin-exposure","no-wan-management"],"how_to_check":"Log in to the Vigor2960 web admin and read the firmware version on the dashboard/System Status; 1.5.1.6 Revision 8218 is affected. Also check whether the web management port is reachable from WAN (System Maintenance > Management > Access Control) and review local user accounts. No CLI command is documented in the sources.","fix":"DrayTek's only statement: 1.5.1.7 'has corrected many security issues' and the 2960 is EoS with limited support (only major issues such as unauthenticated flaws are reviewed). No source confirms 1.5.1.7 fixes this CVE; the VulDB entry says no mitigation known. Upgrade to 1.5.1.7 as a first step, close WAN access to web management (allow only trusted LAN or VPN), audit and remove unneeded accounts, and plan replacement.","status":"open","published_at":"2026-10-20T13:16:40+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-23T22:39:34+00:00","updated_at":"2026-10-23T23:21:17+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-10-23T22:39:34Z","model":"claude-haiku-5-5","output":{"fix":"The vendor says the Vigor2960 is end-of-support with limited patching; 1.5.1.7 fixes many issues, but the sources do not confirm it fixes this flaw. Restrict or disable WAN access to the web admin interface, or replace the device.","reach":"internet","title":"DrayTek Vigor2960 router: command injection in CGI interface lets remote attackers run commands","impact":"high","summary":"The DrayTek Vigor2960 router firmware 1.5.1.6 Revision 8218 has an OS command injection flaw in the /cgi-bin/mainfunction.cgi web interface, via the usefile, usescript and option arguments. A remote attacker can run operating system commands on the device, and a public exploit has been published.","category":"infrastructure","who_cares":["draytek","vigor2960","self-hosted","network-appliance"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote attacker runs operating system commands on the router","analyst_note":"Check whether 1.5.1.7 or a later build fixes CVE-2026-113390 and whether the CGI endpoint needs authentication, using the NVD entry and DrayTek's advisories.","how_to_check":"Check the firmware version under the router admin page or system status; versions 1.5.1.6 Revision 8218 are affected. Confirm whether the web management interface is reachable from the internet.","needs_analyst":true,"not_affected_if":["default-config","no-wan-admin-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000581,"input_tokens":3061,"output_tokens":549,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact firmware check command and whether the web management interface needs login; the sources do not state these, and the vendor says the device is end-of-support, so check the NVD and vendor advisory pages.","search":"'-113390':16A,19A '-2026':15A,18A '/cgi-bin/mainfunction.cgi':47B,113C '1.5.1.6':38B,98C '1.5.1.7':149C '182b0':50B,109C '2960':148C,156C '8218':40B,100C 'affect':101C,174C 'applianc':29B 'argument':51B,123C 'attack':11A,54B,133C 'caus':125C 'cgi':7A,117C 'command':4A,13A,44B,127C 'compon':116C 'concept':73B 'correct':151C 'cve':14A,17A 'cvss':66B 'devic':84B 'draytek':1A,21B,35B,96C 'e.g':168C 'end':23B,87B 'end-of-support':22B,86B 'eo':158C 'exist':74B 'explain':147C 'exploit':76B,130C,137C 'file':112C 'firmwar':37B 'flaw':91C 'found':94C 'function':48B,107C 'host':33B 'infrastructur':26B 'inject':5A,45B,128C 'interfac':8A,65B,118C 'issu':104C,154C,164C 'l':68B 'let':9A 'limit':160C 'login':61B 'longer':179C 'low':59B 'low-privileg':58B 'maintain':183C 'major':163C 'mani':152C 'manipul':120C 'may':142C 'need':55B 'network':28B 'network-appli':27B 'os':43B,126C 'possibl':135C 'pr':67B 'privileg':60B 'product':175C 'proof':71B 'public':70B 'publish':140C 'remot':10A,129C 'report':82B 'review':167C 'revis':39B,99C 'router':3A,30B 'run':12A 'secur':153C 'self':32B 'self-host':31B 'sub':49B,108C 'support':25B,89B,161C,180C 'unauthent':169C 'use':144C 'usefile/usescript/option':52B,124C 'valid':57B 'vendor':146C 'vigor2960':2A,20A,34B,36B,97C 'vuln':170C 'vulner':172C 'web':64B 'wild':79B 'would':165C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T13:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113390","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113390","severity":null,"published_at":"2026-10-20T13:16:40+00:00","modified_at":"2026-10-22T22:18:03+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113390:422","url":null,"severity":null,"published_at":"2026-10-23T23:21:17+00:00","modified_at":"2026-10-23T23:21:17+00:00","first_seen_at":"2026-10-23T23:21:17+00:00","fetched_at":"2026-10-23T23:21:17+00:00","note":"CVE record + VulDB read: CVSS vector PR:L so a (low-privilege) login is required, not unauthenticated; PoC on GitHub (link locked behind VulDB, not read); no exploitation reported; DrayTek published no advisory of its own. Sibling CVEs 113389/113391/113394 same device."}],"documents":[{"id":1908,"url":"https://www.cve.org/CVERecord?id=CVE-2026-113390","title":"CVE Record: CVE-2026-113390","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1905,"url":"https://vuldb.com/vuln/422666","title":"VulDB VDB-422666: Vigor2960 mainfunction.cgi os command injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1903,"url":"https://lekkenradar.nl/draytek-vigor2960-lekken-firmware-1-5-1-6-oktober-2026/","title":"DrayTek Vigor2960: 8 lekken in firmware 1.5.1.6","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}