CVE-2026-113397
Received Received - Intake

Command Injection in DrayTek Vigor2960

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 mitigates this issue. Upgrading the affected component is recommended. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113397
EUVD
EUVD-2026-105016

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DrayTek Vigor2960 1.5.1.6 Revision 8218

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a command injection flaw in DrayTek Vigor2960 firmware version 1.5.1.6. It affects the request_certificate function in /cgi-bin/mainfunction.cgi. An attacker can manipulate the option parameter in a POST request to inject arbitrary commands into the system shell. The vulnerability exists because user input is directly inserted into a shell command without proper sanitization.

Detection Guidance

Check for unauthorized POST requests to /cgi-bin/mainfunction.cgi with manipulated option parameters. Monitor for reverse shell connections or unusual command execution patterns. Review logs for administrative access followed by unexpected certificate-related operations.

Impact Analysis

An attacker with administrative access can execute arbitrary commands on the device with the privileges of the mainfunction.cgi process. This could lead to full system compromise, data theft, or the device being used as a pivot point in a larger attack. Successful exploitation requires an authenticated session.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected devices may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade the DrayTek Vigor2960 firmware to version 1.5.1.7 immediately. Disable administrative access if not required. Implement network segmentation to limit exposure. Monitor for signs of exploitation and restrict outbound connections from the device.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113397. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart