DrayTek Vigor2960 Command Injection Flaw Exposes End-of-Support Devices

Security teams managing legacy network infrastructure face an immediate threat from a disclosed command injection vulnerability in DrayTek routers. The flaw, identified as CVE-2026-113391, affects the Vigor2960 model running firmware version 1.5.1.6 Revision 8218. According to the National Vulnerability Database, the issue allows remote attackers to inject commands through the uploadlangs function in the /cgi-bin/mainfunction.cgi file. The exploit code has been made public, increasing the risk of automated scanning and exploitation in exposed environments.

Which environments are exposed to this specific flaw?

The source material states that this vulnerability only affects products that are no longer supported by the maintainer. Specifically, it impacts DrayTek Vigor2960 1.5.1.6 Revision 8218. The record does not mention other versions or models. Because the Vigor2960 line is officially end-of-support, organizations may have continued using older firmware versions. This limited support status means that only major issues, such as unauthenticated vulnerabilities, are typically reviewed for remediation by the maintainer.

How severe is the technical impact?

The National Vulnerability Database assigns a CVSS score of 9.4 to CVE-2026-113391, classifying it as critical. The record highlights weaknesses CWE-77 (Improper Neutralization of Special Elements used in an OS Command) and CWE-74 (Improper Neutralization of Input During Web Page Generation). These flaws enable remote command injection, meaning an attacker does not need local access or authentication to execute arbitrary commands on the device. The public disclosure of the exploit further elevates the urgency for any organization still operating the affected firmware version.

Is there a fix for affected systems?

DrayTek has released firmware version 1.5.1.7 to address this security issue. The vendor states that this update corrects many security issues, including the command injection flaw. However, the company emphasizes that the Vigor2960 is end-of-support, and future reviews will be limited to major issues like unauthenticated vulnerabilities. Users are recommended to upgrade to the patched version to mitigate the risk. No other fixes or workarounds are mentioned in the source material for this specific CVE.

What does end-of-support mean for future security?

The vendor explicitly notes that the Vigor2960 is end-of-support with limited support. This means that DrayTek will not provide regular security updates or feature enhancements for this model. Only critical issues, such as unauthenticated vulnerabilities, may be reviewed and patched. Organizations relying on this hardware must assess the risk of continued use, as the lack of comprehensive support could leave other potential vulnerabilities unaddressed in the future.

Detection notes

Teams usually monitor web server logs for unusual POST requests to CGI endpoints like mainfunction.cgi. Look for parameters containing shell metacharacters such as pipes, semicolons, or backticks, which indicate command injection attempts. Check for outbound traffic from the router to unexpected external IPs, which could signal command and control activity. If anomalous behavior is detected, isolate the device from the network immediately to prevent lateral movement. Review firewall rules to block unauthorized access to management interfaces. Verify that no unauthorized files have been uploaded or created on the device storage.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: DrayTek

• Inventory all network devices to identify any DrayTek Vigor2960 units running firmware version 1.5.1.6 Revision 8218.
• Apply the firmware update to version 1.5.1.7 as soon as possible to mitigate the command injection vulnerability.
• Monitor network logs for suspicious activity targeting the /cgi-bin/mainfunction.cgi endpoint, especially from untrusted sources.
• Consider replacing end-of-support hardware with actively maintained alternatives to reduce long-term security risks.

Step-by-step guide: Lateral Movement Prevention Checklist for Network Security

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-113391?

The National Vulnerability Database rates CVE-2026-113391 as critical with a CVSS score of 9.4.

Which firmware version fixes the command injection flaw?

Upgrading to DrayTek Vigor2960 firmware version 1.5.1.7 mitigates the issue.

Is the DrayTek Vigor2960 still supported?

No, the vendor states that the Vigor2960 is end-of-support with limited support for major issues only.