DrayTek Vigor2960 Update Fixes Critical Remote Command Injection Flaw

DrayTek released version 1.5.1.7 for the Vigor2960 to address a critical, publicly disclosed remote command injection vulnerability in the upload endpoint.

Threat Times Exposure DeskOctober 20, 20261 min read

Share LinkedIn Reddit

Updated October 20, 2026 with new details.

Illustration: A white industrial router sits on a cluttered desk, its side panel removed to expose the internal circuit board. — AI-generated illustration: Threat Times

Key points

DrayTek Vigor2960 version 1.5.1.6 Revision 8218 contains a critical remote code execution flaw.
The vulnerability allows unauthenticated attackers to inject commands via the uploadlangs function.
Version 1.5.1.7 mitigates the issue, though the product line is officially end-of-life.

DrayTek has released firmware version 1.5.1.7 for its Vigor2960 router to address a critical security vulnerability that allows remote command injection. The flaw, tracked as CVE-2026-113391, affects devices running version 1.5.1.6 Revision 8218 and has been assigned a CVSS score of 9.4, indicating a critical severity level according to National Vulnerability Database records.

At a glance

CVE: CVE-2026-113391
Product: DrayTek Vigor2960
CVSS: 9.4 Critical
Weakness: command injection
Exploited: No known exploitation

The vulnerability resides in the uploadlangs function within the /cgi-bin/mainfunction.cgi file, specifically within the Upload Endpoint component. Attackers can exploit this weakness to inject operating system commands remotely. The exploit code has been disclosed to the public, meaning malicious actors can currently use it to compromise affected systems.

Context and Background

The National Vulnerability Database lists two severity ratings for this specific CVE, with one entry noting a CVSS score of 8.6, classified as high severity. Both records identify the same underlying weaknesses, citing CWE-77 for improper neutralization of special elements used in an OS command and CWE-74 for improper neutralization of output during data transmission.

DrayTek stated that version 1.5.1.7 corrects many security issues found in the previous release. The vendor emphasized that the Vigor2960 product line is end-of-life (EoS) and receives only limited support. According to the vendor, only major issues, such as unauthenticated vulnerabilities like this one, are reviewed for potential fixes.

Who Is Affected

This vulnerability specifically impacts DrayTek Vigor2960 devices running firmware version 1.5.1.6 Revision 8218. The National Vulnerability Database notes that this flaw only affects products that are no longer supported by the maintainer. Organizations still operating these specific router models are exposed to remote exploitation until they apply the available firmware update.

What should you do?

Security teams should immediately verify the firmware version of their DrayTek Vigor2960 routers. If the device is running version 1.5.1.6 Revision 8218, administrators should upgrade to version 1.5.1.7 to mitigate the risk. Since the exploit is public, exposure to the internet significantly increases the likelihood of compromise.

What to do and how to stay safe: DrayTek

Check current firmware versions on all DrayTek Vigor2960 devices to identify those running 1.5.1.6 Revision 8218.
Upgrade affected devices to firmware version 1.5.1.7 as soon as possible to close the remote code execution gap.
Monitor network traffic for unusual outbound connections or command execution patterns that may indicate exploitation.
Consider replacing end-of-life hardware with supported alternatives to ensure long-term security maintenance.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.