---
id: "CVE-2026-113397"
kind: "vulnerability"
aliases: ["CVE-2026-113397"]
title: "DrayTek Vigor2960 router: IPsec certificate request enables remote command injection"
severity: "high"
cvss: 7.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["draytek", "infrastructure", "ipsec", "routers", "self-hosted", "vigor2960"]
not_affected_if: ["newer-firmware", "no-vigor2960"]
published_at: "2026-10-20T15:17:18+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:27:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113397", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# DrayTek Vigor2960 router: IPsec certificate request enables remote command injection

The DrayTek Vigor2960 1.5.1.6 router accepts a crafted option argument in the IPsec certificate request handler at /cgi-bin/mainfunction.cgi, which lets a remote attacker inject operating system commands. A public exploit has been disclosed, and the vendor says the product is end-of-support with limited fixes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router admin page or with the device's system information screen; affected build is `1.5.1.6 Revision 8218`.
- Confirm whether the web management interface is reachable from the internet, since the attack can be launched remotely.

## Fix

- Upgrade the Vigor2960 to `1.5.1.7` per the sources, which the vendor says corrects many security issues.
- The vendor notes the 2960 is end-of-support with limited support, so if no upgrade path exists, plan replacement or restrict access to the management interface.

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113397

## From the sources

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_