Key points
- CVE-2026-113390 affects DrayTek Vigor2960 version 1.5.1.6 Revision 8218.
- The flaw is rated critical with a CVSS score of 9.4.
- DrayTek has released version 1.5.1.7 to correct the security issues.
DrayTek Vigor2960 routers running version 1.5.1.6 Revision 8218 are affected by a critical security flaw identified as CVE-2026-113390. The vendor has released version 1.5.1.7 to address this vulnerability. Users of the affected version should update their devices immediately to prevent potential remote exploitation.
In plain English
The vulnerability exists in the CGI Interface component of the router. Specifically, the function sub_182B0 within the file /cgi-bin/mainfunction.cgi fails to properly validate input. Attackers can manipulate the usefile, usescript, or option arguments to inject operating system commands. This allows remote exploitation without requiring authentication.
The background
National Vulnerability Database records list the flaw with a CVSS score of 9.4, classifying it as critical. Some records also list a score of 8.6, which is high. The weaknesses are categorized as CWE-78 and CWE-77, indicating improper neutralization of special elements in OS commands. An exploit for this issue has been published and is available for use.
What changes now
DrayTek states that version 1.5.1.7 has corrected many security issues. The vendor notes that the Vigor2960 is at end of support. Limited support remains only for major issues, such as unauthenticated vulnerabilities. This update is one of the few remaining fixes for this product line.
Who needs to act first
Teams should prioritize updating systems that are directly exposed to the internet. Check whether any Vigor2960 devices are accessible from public networks. Roll out the fix to these high-risk systems first. Test the update in a non-production environment if possible. Back up device configurations before applying the change. Monitor logs for unusual activity during the transition.
What to do and how to stay safe: DrayTek
- Verify the current firmware version on all DrayTek Vigor2960 devices.
- Download and install version 1.5.1.7 from the vendor's official site.
- Block access to the /cgi-bin/mainfunction.cgi endpoint until updates are complete.
- Monitor network traffic for signs of command injection attempts.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which version of DrayTek Vigor2960 is affected?
Version 1.5.1.6 Revision 8218 is affected by this vulnerability.
Is there a fix available?
Yes, DrayTek has released version 1.5.1.7 to correct the issues.
What is the severity of CVE-2026-113390?
It is rated critical with a CVSS score of 9.4.
