Command Injection Vulnerability in DrayTek Vigor2960 Router
CVE-2026-113391

9.4CRITICAL

Key Information:

Vendor

Draytek
Status
Vigor2960
Vendor
CVE Published:
20 October 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-113391?

A command injection vulnerability exists in DrayTek Vigor2960 routers, specifically in version 1.5.1.6 Revision 8218. The issue is located in the uploadlangs function of the /cgi-bin/mainfunction.cgi file within the Upload Endpoint component. This vulnerability allows attackers to manipulate the affected function remotely, potentially leading to significant security risks. The vendor has acknowledged the issue and recommends upgrading to version 1.5.1.7, which addresses multiple security concerns. It is important to note that the impacted products are no longer actively maintained by the vendor, leading to increased risks for users who do not implement the necessary updates.

Affected Version(s)

Vigor2960 1.5.1.6 Revision 8218

Vigor2960 1.5.1.7

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-113391 - Proof of Concept

References

https://vuldb.com/vuln/422667
vdb-entrytechnical-description
https://vuldb.com/vuln/422667/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-113391
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

eqqie (VulDB User)
VulDB CNA Team
.