{"id":"CVE-2026-113397","kind":"vulnerability","aliases":["CVE-2026-113397"],"related":[],"title":"DrayTek Vigor2960 router: IPsec certificate request enables remote command injection","description":"A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","summary":"The DrayTek Vigor2960 1.5.1.6 router accepts a crafted option argument in the IPsec certificate request handler at /cgi-bin/mainfunction.cgi, which lets a remote attacker inject operating system commands. A public exploit has been disclosed, and the vendor says the product is end-of-support with limited fixes.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["draytek","infrastructure","ipsec","routers","self-hosted","vigor2960"],"not_affected_if":["newer-firmware","no-vigor2960"],"how_to_check":"- Check the firmware version on the router admin page or with the device's system information screen; affected build is `1.5.1.6 Revision 8218`.\n- Confirm whether the web management interface is reachable from the internet, since the attack can be launched remotely.","fix":"- Upgrade the Vigor2960 to `1.5.1.7` per the sources, which the vendor says corrects many security issues.\n- The vendor notes the 2960 is end-of-support with limited support, so if no upgrade path exists, plan replacement or restrict access to the management interface.","status":"open","published_at":"2026-10-20T15:17:18+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:27:07+00:00","updated_at":"2026-10-25T03:27:07+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-10-25T03:27:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Vigor2960 to `1.5.1.7` per the sources, which the vendor says corrects many security issues.\n- The vendor notes the 2960 is end-of-support with limited support, so if no upgrade path exists, plan replacement or restrict access to the management interface.","reach":"internet","title":"DrayTek Vigor2960 router: IPsec certificate request enables remote command injection","impact":"high","summary":"The DrayTek Vigor2960 1.5.1.6 router accepts a crafted option argument in the IPsec certificate request handler at /cgi-bin/mainfunction.cgi, which lets a remote attacker inject operating system commands. A public exploit has been disclosed, and the vendor says the product is end-of-support with limited fixes.","category":"infrastructure","nicknames":[],"who_cares":["draytek","vigor2960","routers","ipsec","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Remote attacker runs operating system commands on the router","analyst_note":"Confirm whether the flaw needs authentication and whether the vendor published a 1.5.1.7 advisory beyond the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113397.","how_to_check":"- Check the firmware version on the router admin page or with the device's system information screen; affected build is `1.5.1.6 Revision 8218`.\n- Confirm whether the web management interface is reachable from the internet, since the attack can be launched remotely.","needs_analyst":true,"not_affected_if":["newer-firmware","no-vigor2960"],"who_is_affected":"Teams running DrayTek Vigor2960 routers on firmware `1.5.1.6 Revision 8218` are exposed, especially if the IPsec handler or web management interface is reachable from untrusted networks. Sources do not say whether the flaw is reachable without authentication, so treat the device as at risk until the firmware is confirmed. Teams on newer firmware or with no Vigor2960 in service can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":3478,"output_tokens":746,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-113397':13A,16A '-2026':12A,15A '/cgi-bin/mainfunction.cgi':42B,93C '1.5.1.6':28B,81C '1.5.1.7':128C,142C '2960':141C,149C '8218':83C 'accept':30B 'affect':85C,134C,167C 'argument':34B,103C 'attack':47B,110C 'certif':5A,38B,89C 'command':9A,51B,107C 'compon':96C,135C 'correct':144C 'craft':32B 'cve':11A,14A 'detect':77C 'disclos':57B,119C 'draytek':1A,17B,26B,79C 'e.g':161C 'enabl':7A 'end':66B 'end-of-support':65B 'eo':151C 'explain':140C 'exploit':54B,116C 'file':92C 'fix':71B 'function':87C 'handler':40B,98C 'host':23B 'infrastructur':18B 'inject':10A,48B,108C 'ipsec':4A,19B,37B,97C 'issu':131C,147C,157C 'launch':113C 'lead':105C 'let':44B 'limit':70B,153C 'longer':172C 'maintain':176C 'major':156C 'mani':145C 'manipul':100C 'may':122C 'mitig':129C 'oper':49B 'option':33B,104C 'product':63B,168C 'public':53B,120C 'recommend':137C 'remot':8A,46B,114C 'request':6A,39B 'review':160C 'revis':82C 'router':3A,20B,29B 'ruequest':88C 'say':61B 'secur':73C,146C 'self':22B 'self-host':21B 'support':68B,154C,173C 'system':50B 'unauthent':162C 'upgrad':125C,132C 'use':124C 'vendor':60B,139C 'version':127C 'vigor2960':2A,24B,27B,80C 'vuln':163C 'vulner':74C,165C 'would':158C","nicknames":[],"mitigations":[],"who_affected":"Teams running DrayTek Vigor2960 routers on firmware `1.5.1.6 Revision 8218` are exposed, especially if the IPsec handler or web management interface is reachable from untrusted networks. Sources do not say whether the flaw is reachable without authentication, so treat the device as at risk until the firmware is confirmed. Teams on newer firmware or with no Vigor2960 in service can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T15:17:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113397","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113397","severity":null,"published_at":"2026-10-20T15:17:18+00:00","modified_at":"2026-10-20T19:27:34+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}