---
id: "CVE-2026-129449"
page: "https://infrastack.ai/live/CVE-2026-129449"
kind: "vulnerability"
aliases: ["CVE-2026-129449"]
title: "DrayTek Vigor2960 router: command injection via mainfunction.cgi lets remote attackers run commands"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["draytek", "infrastructure", "network-edge", "routers", "vigor2960"]
not_affected_if: ["firmware-newer-than-1.5.1.6", "other-models"]
published_at: "2026-11-15T11:17:10+00:00"
first_seen_at: "2026-11-15T11:35:15+00:00"
updated_at: "2026-11-15T11:35:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129449", "first_seen_at": "2026-11-15T11:35:15+00:00"}]
exploit_sources: []
---

# DrayTek Vigor2960 router: command injection via mainfunction.cgi lets remote attackers run commands

Link for people: https://infrastack.ai/live/CVE-2026-129449 (this .md is for agents)

DrayTek Vigor2960 routers up to firmware 1.5.1.6 let a remote attacker inject commands through the swmconfigupload argument of /cgi-bin/mainfunction.cgi. The exploit has been disclosed publicly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router's admin interface and compare it to `1.5.1.6`
- Check whether the web management interface is reachable from the internet

## Fix

- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description; the vendor says a further release is planned

## Timeline

- 2026-11-15T11:35:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129449

## From the sources

A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 addresses this issue. It is advisable to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_