---
id: "CVE-2026-129452"
page: "https://infrastack.ai/live/CVE-2026-129452"
kind: "vulnerability"
aliases: ["CVE-2026-129452"]
title: "DrayTek Vigor2960: remote command injection via router web interface jsondata"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["draytek", "infrastructure", "network-appliance", "router", "vigor2960"]
not_affected_if: ["management-interface-not-exposed", "other-firmware"]
published_at: "2026-11-15T13:16:59+00:00"
first_seen_at: "2026-11-15T13:36:04+00:00"
updated_at: "2026-11-15T13:36:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129452", "first_seen_at": "2026-11-15T13:36:04+00:00"}]
exploit_sources: []
---

# DrayTek Vigor2960: remote command injection via router web interface jsondata

Link for people: https://infrastack.ai/live/CVE-2026-129452 (this .md is for agents)

The set_table function in the /cgi-bin/mainfunction.cgi web endpoint of DrayTek Vigor2960 firmware 1.5.1.6 does not sanitize the jsondata argument. A remote attacker can inject operating system commands through it, and public exploit details exist.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the firmware version on the router's admin interface; affected version is `1.5.1.6`.
- Check whether the router's web admin interface, including `/cgi-bin/mainfunction.cgi`, is reachable from the internet.

## Fix

- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description.
- The vendor says a further release is planned to address the reported issues; the sources do not give its version.

## Timeline

- 2026-11-15T13:36:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129452

## From the sources

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6. This vulnerability affects the function set_table of the file /cgi-bin/mainfunction.cgi. Such manipulation of the argument jsondata leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to resolve this issue. It is suggested to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_