{"id":"CVE-2026-129452","kind":"vulnerability","aliases":["CVE-2026-129452"],"related":[],"title":"DrayTek Vigor2960: remote command injection via router web interface jsondata","description":"A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function set_table of the file /cgi-bin/mainfunction.cgi. Such manipulation of the argument jsondata leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor recommends: \"1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.\"","summary":"The set_table function in the /cgi-bin/mainfunction.cgi web endpoint of DrayTek Vigor2960 firmware 1.5.1.6 does not sanitize the jsondata argument. A remote attacker can inject operating system commands through it, and public exploit details exist.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["draytek","infrastructure","network-appliance","router","vigor2960"],"not_affected_if":["management-interface-not-exposed","other-firmware"],"how_to_check":"- Check the firmware version on the router's admin interface; affected version is `1.5.1.6`.\n- Check whether the router's web admin interface, including `/cgi-bin/mainfunction.cgi`, is reachable from the internet.","fix":"- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description.\n- The vendor says a further release is planned to address the reported issues; the sources do not give its version.","status":"open","published_at":"2026-11-15T13:16:59+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","triaged_at":"2026-11-15T13:36:24+00:00","updated_at":"2026-11-15T13:36:24+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-15T13:36:24Z","model":"claude-haiku-5-5","output":{"fix":"- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description.\n- The vendor says a further release is planned to address the reported issues; the sources do not give its version.","reach":"internet","title":"DrayTek Vigor2960: remote command injection via router web interface jsondata","impact":"high","summary":"The set_table function in the /cgi-bin/mainfunction.cgi web endpoint of DrayTek Vigor2960 firmware 1.5.1.6 does not sanitize the jsondata argument. A remote attacker can inject operating system commands through it, and public exploit details exist.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["draytek","vigor2960","router","network-appliance"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the router remotely.","analyst_note":"Confirm the fixed version and whether 1.5.1.7 is final, given the vendor says another release is planned; check the DrayTek security advisory and NVD entry for auth and default-config requirements.","how_to_check":"- Check the firmware version on the router's admin interface; affected version is `1.5.1.6`.\n- Check whether the router's web admin interface, including `/cgi-bin/mainfunction.cgi`, is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware","management-interface-not-exposed"],"who_is_affected":"Organizations running DrayTek Vigor2960 routers on firmware 1.5.1.6 are exposed, particularly where the web management interface is reachable from the internet. Routers on other firmware versions or with the management interface restricted to a trusted internal network are less exposed. The sources do not state whether the interface must be enabled or whether login is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001134,"input_tokens":4661,"output_tokens":1335,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-129452':13A,16A '-2026':12A,15A '/cgi-bin/mainfunction.cgi':30B,78C '1.5.1.6':37B,67C,128C '1.5.1.7':110C '2960':135C 'abl':112C 'affect':70C,123C 'anoth':146C 'applianc':21B 'argument':43B,83C 'attack':46B,90C 'command':4A,51B,87C 'compon':124C 'cve':11A,14A 'detail':57B 'disclos':99C 'draytek':1A,17B,34B,65C 'endpoint':32B 'exist':58B 'exploit':56B,96C 'file':77C 'firmwar':36B 'fix':139C 'found':63C 'function':27B,72C 'infrastructur':18B 'inject':5A,48B,88C 'interfac':9A 'isn':129C 'issu':116C,142C,156C 'jsondata':10A,42B,84C 'latest':132C,137C 'launch':93C 'lead':85C 'mani':140C 'manipul':80C 'may':104C 'network':20B 'network-appli':19B 'one':147C 'oper':49B 'plan':151C 'public':55B,102C 'recommend':127C 'releas':150C 'remot':3A,45B,94C 'report':157C 'resolv':114C 'router':7A,22B 'sanit':40B 'secur':141C 'set':25B,73C 'solv':154C 'suggest':119C 'system':50B 'tabl':26B,74C 'upgrad':107C,121C 'use':106C 'vendor':126C 'version':109C,133C,138C 'via':6A 'vigor2960':2A,23B,35B,66C 'vulner':60C,69C 'web':8A,31B","nicknames":[],"mitigations":[],"who_affected":"Organizations running DrayTek Vigor2960 routers on firmware 1.5.1.6 are exposed, particularly where the web management interface is reachable from the internet. Routers on other firmware versions or with the management interface restricted to a trusted internal network are less exposed. The sources do not state whether the interface must be enabled or whether login is required.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","draytek","infrastructure","networkappliance","router","vigor2960"],"campaign_type":null,"search_a":"'-129452':13A,16A '-2026':12A,15A 'command':4A 'cve':11A,14A 'draytek':1A 'inject':5A 'interfac':9A 'jsondata':10A 'remot':3A 'router':7A 'via':6A 'vigor2960':2A 'web':8A","search_b":"'/cgi-bin/mainfunction.cgi':30B '1.5.1.6':37B 'applianc':21B 'argument':43B 'attack':46B 'command':51B 'detail':57B 'draytek':17B,34B 'endpoint':32B 'exist':58B 'exploit':56B 'firmwar':36B 'function':27B 'infrastructur':18B 'inject':48B 'jsondata':42B 'network':20B 'network-appli':19B 'oper':49B 'public':55B 'remot':45B 'router':22B 'sanit':40B 'set':25B 'system':50B 'tabl':26B 'vigor2960':23B,35B 'web':31B","search_c":"'/cgi-bin/mainfunction.cgi':78C '1.5.1.6':67C,128C '1.5.1.7':110C '2960':135C 'abl':112C 'affect':70C,123C 'anoth':146C 'argument':83C 'attack':90C 'command':87C 'compon':124C 'disclos':99C 'draytek':65C 'exploit':96C 'file':77C 'fix':139C 'found':63C 'function':72C 'inject':88C 'isn':129C 'issu':116C,142C,156C 'jsondata':84C 'latest':132C,137C 'launch':93C 'lead':85C 'mani':140C 'manipul':80C 'may':104C 'one':147C 'plan':151C 'public':102C 'recommend':127C 'releas':150C 'remot':94C 'report':157C 'resolv':114C 'secur':141C 'set':73C 'solv':154C 'suggest':119C 'tabl':74C 'upgrad':107C,121C 'use':106C 'vendor':126C 'version':109C,133C,138C 'vigor2960':66C 'vulner':60C,69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T13:16:59+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129452","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129452","severity":null,"published_at":"2026-11-15T13:16:59+00:00","modified_at":"2026-11-15T13:16:59+00:00","first_seen_at":"2026-11-15T13:36:04+00:00","fetched_at":"2026-11-15T13:36:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}