CVE-2026-113396
Received Received - Intake

Command Injection in DrayTek Vigor2960

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113396
EUVD
EUVD-2026-105013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DrayTek Vigor2960 1.5.1.6 Revision 8218

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated command injection vulnerability in DrayTek Vigor2960 router firmware version 1.5.1.6. It exists in the rename_table function of the /cgi-bin/mainfunction.cgi component. The newtable parameter is improperly sanitized and directly inserted into a shell command, allowing attackers to inject malicious commands. Exploitation requires administrator authentication and can lead to remote code execution.

Detection Guidance

To detect this vulnerability, check if your DrayTek Vigor2960 router is running firmware version 1.5.1.6 (revision 8218). Monitor network traffic for POST requests to /cgi-bin/mainfunction.cgi with the action parameter set to rename_table. Look for suspicious newtable parameter values containing command injection payloads or Base64-encoded reverse shell commands.

Impact Analysis

An attacker could gain shell-level access to the router with CGI process privileges. This could allow them to execute arbitrary commands, install malware, modify router settings, intercept network traffic, or use the device as a pivot point for further attacks within the network.

Mitigation Strategies

Immediately upgrade the firmware to version 1.5.1.7 or later. If upgrading is not possible, restrict administrative access to the router, disable remote management features, and monitor for unauthorized commands or shell access. Consider replacing the device as it is end-of-life with limited support.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113396. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart