CVE-2026-113393
Received Received - Intake

Unrestricted File Upload in DrayTek Vigor2960

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113393
EUVD
EUVD-2026-105001

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DrayTek Vigor2960 1.5.1.6 Revision 8218

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authenticated arbitrary file clobber and command injection flaw in DrayTek Vigor2960 router firmware version 1.5.1.6. It affects the /cgi-bin/mainfunction.cgi/commonupload endpoint where an attacker with admin access can manipulate upload_path and upload_name parameters to write arbitrary files or execute root commands via unsanitized shell command injection.

Detection Guidance

Check for unauthorized file uploads or modifications in root-writable directories like /var/status_system_interface. Inspect network traffic for POST requests to /cgi-bin/mainfunction.cgi with upload_path or upload_name parameters. Review logs for suspicious shell commands containing special characters like &, |, or ;.

Impact Analysis

An attacker could overwrite critical system files, install malware, or execute arbitrary commands with root privileges. This could lead to complete device compromise, data theft, or denial of service. Since the device is end-of-life with limited support, patches may not be available.

Mitigation Strategies

Upgrade to firmware version 1.5.1.7 immediately. Restrict administrative access to the router. Disable unnecessary services and monitor for unusual file writes or command executions. Apply network segmentation to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113393. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart