Read the docs
TI-2026-76868 Aliases CVE-2026-113391GHSA-f3vf-pm24-g43p

Command injection in DrayTek Vigor2960 upload endpoint

Priority HIGH 76CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

DrayTek Vigor2960 version 1.5.1.6 Revision 8218 is affected. Manipulated input to the uploadlangs function in the Upload Endpoint at /cgi-bin/mainfunction.cgi lets attackers inject commands (CWE-77). A remote attacker with low privileges can trigger it without user interaction. The exploit has been publicly disclosed and may be used.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02063 81st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Vigor2960 (DrayTek): 1.5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor29601.5.1.6 Revision 82181.5.1.7Patch availableCNA
  • Vigor2960 VendorDrayTek Affected 1.5.1.6 Revision 8218 Fixed in 1.5.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*——DrayTek
  • cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* Versions — — ·DrayTek

Remediation

Upgrade DrayTek Vigor2960 to version 1.5.1.7, which mitigates this issue. The vendor says the Vigor2960 is end of support (EoS) with limited support, so only major issues are reviewed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vigor2960 (DrayTek) Fixed in 1.5.1.7

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113391
  2. 2026-10-20 Alias added: GHSA-f3vf-pm24-g43p

References

Exploit 1

Patch 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences