DrayTek Vigor2960 Faces Critical Remote Command Injection Flaw

DrayTek has acknowledged a critical security vulnerability in its Vigor2960 router that allows for remote command injection. The flaw, tracked as CVE-2026-113390, affects devices running firmware version 1.5.1.6 Revision 8218 and has been assigned a CVSS score of 9.4 by the National Vulnerability Database. This high-severity issue permits attackers to execute arbitrary operating system commands from a remote location.

The vulnerability resides within the CGI Interface component of the router's web management system. Specifically, the flaw is located in the function sub_182B0 of the file /cgi-bin/mainfunction.cgi. Attackers can exploit this issue by manipulating the usefile, usescript, or option arguments. This manipulation leads to OS command injection, as classified by CWE-78 and CWE-77. Remote exploitation is possible, and an exploit for this vulnerability has already been published and may be in use.

Vendor Response and Support Status

DrayTek has released a statement regarding the security of the Vigor2960 line. The vendor explained that version 1.5.1.7 has corrected many security issues, including those related to this vulnerability. However, DrayTek noted that the Vigor2960 is officially end-of-support. The company stated that limited support is provided, and only major issues, such as unauthenticated vulnerabilities, would be reviewed. This indicates that while a fix exists in a newer version, the product line is no longer under active maintenance for general updates.

The National Vulnerability Database records confirm that this vulnerability only affects products that are no longer supported by the maintainer. Despite the end-of-support status, the severity of the flaw remains high due to its remote nature and the ease of exploitation. The publication of the exploit code increases the risk for organizations still deploying this specific firmware version. Security researchers have highlighted the importance of patching even legacy systems when critical flaws are disclosed.

Affected Systems and Scope

The primary system affected is the DrayTek Vigor2960 running firmware version 1.5.1.6 Revision 8218. This specific revision is vulnerable to the command injection attack via the CGI interface. Organizations that have not updated their firmware beyond this revision are at risk. The vulnerability does not affect other DrayTek products or newer firmware versions that have incorporated the security fixes. Users of the Vigor2960 should verify their current firmware version immediately to determine if they are exposed to this threat.

What should you do?

Organizations using DrayTek Vigor2960 routers should immediately check their firmware versions. If the device is running version 1.5.1.6 Revision 8218, it is vulnerable to remote command injection. Users should upgrade to version 1.5.1.7 or later, which contains corrections for many security issues. Since the product is end-of-support, consider migrating to a supported device if possible. Monitor network traffic for unusual activity that may indicate exploitation of the published exploit.