CVE-2026-113390

Deferred Deferred - Pending Action

Command Injection in DrayTek Vigor2960

Publication date: 2026-10-20

Last updated on: 2026-10-22

Assigner: VulDB

Description

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-22

Generated

2026-11-09

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113390

EUVD

EUVD-2026-104988

Affected Vendors & Products

Vendor	Product	Version / Range
DrayTek	Vigor2960	1.5.1.6 Revision 8218

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

CVE-2026-113390 is an authenticated command injection flaw in DrayTek Vigor2960 router firmware version 1.5.1.6. It allows attackers with admin access to inject malicious commands via the `usefile`, `usescript`, and `option` parameters in the `/cgi-bin/mainfunction.cgi` endpoint. This can lead to arbitrary file deletion or remote code execution with root privileges.

Detection Guidance

To detect this vulnerability, check if your DrayTek Vigor2960 router is running firmware version 1.5.1.6 (revision 8218). Inspect network traffic for requests to /cgi-bin/mainfunction.cgi with parameters like action=jsonstatus, usefile, usescript, or option. Look for unauthorized file deletions or script executions in system logs.

Impact Analysis

An attacker could delete critical system files, execute arbitrary commands, or gain full root access to the router. This could disrupt network operations, expose sensitive data, or allow further attacks on connected devices. Exploitation requires an authenticated admin session.

Compliance Impact

This vulnerability could lead to unauthorized access, data breaches, or system compromise, violating GDPR (data protection) and HIPAA (health data security) requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to exposed sensitive information.

Mitigation Strategies

Upgrade the firmware to version 1.5.1.7 or later, as it addresses security issues. Disable remote administration if not required. Restrict access to the /cgi-bin/mainfunction.cgi endpoint. Monitor for suspicious activity and unauthorized file changes. Consider replacing the device if it is no longer supported.

Hi! I’m here to help you understand CVE-2026-113390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...