Read the docs
TI-2026-76874 Aliases CVE-2026-113397GHSA-4232-cr6c-m4cv

Command injection in DrayTek Vigor2960 IPsec certificate request

Priority MEDIUM 57CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

DrayTek Vigor2960 from 1.5.1.6 Revision 8218 before 1.5.1.7 is affected, and the vendor no longer fully supports this product. The ruequest_certificate function in the IPsec handler does not neutralize the option argument before it is used in a command (CWE-77). A remote attacker with low privileges can inject commands. A public exploit has been disclosed and may be used.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01013 63rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Vigor2960 (DrayTek): 1.5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor29601.5.1.6 Revision 82181.5.1.7Patch availableCNA
  • Vigor2960 VendorDrayTek Affected 1.5.1.6 Revision 8218 Fixed in 1.5.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*——DrayTek
  • cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* Versions — — ·DrayTek

Remediation

Upgrade DrayTek Vigor2960 to version 1.5.1.7, which fixes this issue. The vendor states that the Vigor2960 is end of support with limited support, so only major issues are reviewed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vigor2960 (DrayTek) Fixed in 1.5.1.7

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113397
  2. 2026-10-20 Alias added: GHSA-4232-cr6c-m4cv

References

Exploit 1

Patch 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences