CVE-2026-113389: Command Injection in DrayTek Vigor2960

This vulnerability affects the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218. The issue is a command injection in the CGI process component, specifically in the set_table function of /cgi-bin/mainfunction.cgi. An attacker can remotely manipulate the 'sectiontype' argument to execute arbitrary commands on the device. The vendor notes that version 1.5.1.7 includes fixes for multiple security issues, but the product is end-of-support and only major vulnerabilities (e.g., unauthenticated ones) will be reviewed further. Public exploit code is available, increasing the risk of exploitation.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected device, potentially leading to full compromise of the router. This can result in unauthorized control, data interception, or disruption of network services. The vulnerability has a high CVSS 4.0 score of 9.4, indicating critical impact with network attack vector, low attack complexity, no privileges or user interaction required, and high impacts on confidentiality, integrity, availability, and security requirements.

The vendor has released version 1.5.1.7 which addresses many security issues including this vulnerability. However, the product is end-of-support with limited maintenance. Users should upgrade to version 1.5.1.7 if possible. If upgrading is not feasible due to end-of-support status, consider replacing the device with a supported model. Monitor vendor communications for any additional advisories or mitigations related to this product.