{"id":"CVE-2026-129449","kind":"vulnerability","aliases":["CVE-2026-129449"],"related":[],"title":"DrayTek Vigor2960 router: command injection via mainfunction.cgi lets remote attackers run commands","description":"A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 addresses this issue. It is advisable to upgrade the affected component. The vendor recommends: \"1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.\"","summary":"DrayTek Vigor2960 routers up to firmware 1.5.1.6 let a remote attacker inject commands through the swmconfigupload argument of /cgi-bin/mainfunction.cgi. The exploit has been disclosed publicly.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["draytek","infrastructure","network-edge","routers","vigor2960"],"not_affected_if":["firmware-newer-than-1.5.1.6","other-models"],"how_to_check":"- Check the firmware version on the router's admin interface and compare it to `1.5.1.6`\n- Check whether the web management interface is reachable from the internet","fix":"- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description; the vendor says a further release is planned","status":"open","published_at":"2026-11-15T11:17:10+00:00","first_seen_at":"2026-11-15T11:35:15+00:00","triaged_at":"2026-11-15T11:35:59+00:00","updated_at":"2026-11-15T11:35:59+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-15T11:35:59Z","model":"claude-haiku-5-5","output":{"fix":"- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description; the vendor says a further release is planned","reach":"internet","title":"DrayTek Vigor2960 router: command injection via mainfunction.cgi lets remote attackers run commands","impact":"high","summary":"DrayTek Vigor2960 routers up to firmware 1.5.1.6 let a remote attacker inject commands through the swmconfigupload argument of /cgi-bin/mainfunction.cgi. The exploit has been disclosed publicly.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["draytek","vigor2960","routers","network-edge"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote attacker runs commands on the router","analyst_note":"Confirm whether the admin interface needs login to reach the vulnerable CGI, and check the vendor advisory for the planned release.","how_to_check":"- Check the firmware version on the router's admin interface and compare it to `1.5.1.6`\n- Check whether the web management interface is reachable from the internet","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-models","firmware-newer-than-1.5.1.6"],"who_is_affected":"Organisations running DrayTek Vigor2960 routers on firmware up to 1.5.1.6 are exposed, especially if the web management interface is reachable from the internet. Sites with the interface restricted to a trusted internal network have lower exposure. Anyone not running a Vigor2960 can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000766,"input_tokens":4680,"output_tokens":596,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129449':15A,18A '-2026':14A,17A '/cgi-bin/mainfunction.cgi':44B,75C '1.5.1.6':32B,62C,122C '1.5.1.7':107C '14914':71C '2960':129C 'address':108C 'advis':113C 'affect':63C,117C 'anoth':140C 'argument':42B,80C 'attack':10A,36B,92C 'command':4A,12A,38B,84C 'compon':118C 'cve':13A,16A 'detect':56C 'disclos':49B,98C 'draytek':1A,19B,26B,58C 'edg':23B 'exploit':46B,95C 'file':74C 'firmwar':31B 'fix':133C 'function':69C 'infrastructur':20B 'initi':90C 'inject':5A,37B,85C 'isn':123C 'issu':110C,136C,150C 'latest':126C,131C 'lead':82C 'let':8A,33B 'mainfunction.cgi':7A 'mani':134C 'manipul':77C 'may':101C 'network':22B 'network-edg':21B 'one':141C 'plan':145C 'possibl':88C 'public':50B,99C 'recommend':121C 'releas':144C 'remot':9A,35B,93C 'report':151C 'router':3A,24B,28B 'run':11A 'secur':52C,135C 'solv':148C 'sub':70C 'swmconfigupload':41B,81C 'upgrad':104C,115C 'use':103C 'vendor':120C 'version':106C,127C,132C 'via':6A 'vigor2960':2A,25B,27B,59C 'vulner':53C,66C","nicknames":[],"mitigations":[],"who_affected":"Organisations running DrayTek Vigor2960 routers on firmware up to 1.5.1.6 are exposed, especially if the web management interface is reachable from the internet. Sites with the interface restricted to a trusted internal network have lower exposure. Anyone not running a Vigor2960 can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","draytek","infrastructure","networkedge","routers","vigor2960"],"campaign_type":null,"search_a":"'-129449':15A,18A '-2026':14A,17A 'attack':10A 'command':4A,12A 'cve':13A,16A 'draytek':1A 'inject':5A 'let':8A 'mainfunction.cgi':7A 'remot':9A 'router':3A 'run':11A 'via':6A 'vigor2960':2A","search_b":"'/cgi-bin/mainfunction.cgi':44B '1.5.1.6':32B 'argument':42B 'attack':36B 'command':38B 'disclos':49B 'draytek':19B,26B 'edg':23B 'exploit':46B 'firmwar':31B 'infrastructur':20B 'inject':37B 'let':33B 'network':22B 'network-edg':21B 'public':50B 'remot':35B 'router':24B,28B 'swmconfigupload':41B 'vigor2960':25B,27B","search_c":"'/cgi-bin/mainfunction.cgi':75C '1.5.1.6':62C,122C '1.5.1.7':107C '14914':71C '2960':129C 'address':108C 'advis':113C 'affect':63C,117C 'anoth':140C 'argument':80C 'attack':92C 'command':84C 'compon':118C 'detect':56C 'disclos':98C 'draytek':58C 'exploit':95C 'file':74C 'fix':133C 'function':69C 'initi':90C 'inject':85C 'isn':123C 'issu':110C,136C,150C 'latest':126C,131C 'lead':82C 'mani':134C 'manipul':77C 'may':101C 'one':141C 'plan':145C 'possibl':88C 'public':99C 'recommend':121C 'releas':144C 'remot':93C 'report':151C 'secur':52C,135C 'solv':148C 'sub':70C 'swmconfigupload':81C 'upgrad':104C,115C 'use':103C 'vendor':120C 'version':106C,127C,132C 'vigor2960':59C 'vulner':53C,66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129449","severity":null,"published_at":"2026-11-15T11:17:10+00:00","modified_at":"2026-11-15T11:17:11+00:00","first_seen_at":"2026-11-15T11:35:15+00:00","fetched_at":"2026-11-15T11:35:15+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}