Read the docs
TI-2026-76873 Aliases CVE-2026-113396GHSA-r9v6-xv95-6v78

Command injection in DrayTek Vigor2960 Rename Table handler

Priority MEDIUM 57CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

DrayTek Vigor2960 1.5.1.6 Revision 8218 is affected. The rename_table function in /cgi-bin/mainfunction.cgi does not properly neutralize the newtable argument, letting a remote attacker with low privileges inject commands (CWE-77). A public exploit is available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01566 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Vigor2960 (DrayTek): 1.5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor29601.5.1.6 Revision 82181.5.1.7Patch availableCNA
  • Vigor2960 VendorDrayTek Affected 1.5.1.6 Revision 8218 Fixed in 1.5.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*——DrayTek
  • cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* Versions — — ·DrayTek

Remediation

Upgrade DrayTek Vigor2960 to 1.5.1.7. The vendor says the Vigor2960 is end of support (EoS) with limited support, so only major issues such as unauthenticated vulnerabilities are reviewed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vigor2960 (DrayTek) Fixed in 1.5.1.7

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113396
  2. 2026-10-20 Alias added: GHSA-r9v6-xv95-6v78
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences