CVE-2026-113390: OS Command Injection in DrayTek Vigor2960

This vulnerability exists in the function sub_182B0 of the /cgi-bin/mainfunction.cgi file in the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218. It allows remote attackers to perform OS command injection by manipulating the usefile, usescript, or option arguments in the CGI interface. The vendor notes that version 1.5.1.7 addresses many security issues, but the product is end-of-support and only major issues such as unauthenticated vulnerabilities would be reviewed further. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary operating system commands on the affected device without authentication, potentially leading to full compromise of the device. Given the critical CVSS score of 9.4, the impact includes high confidentiality, integrity, and availability risks. The device could be controlled or disrupted by attackers.

The vendor has released version 1.5.1.7 which addresses many security issues, but the affected version 1.5.1.6 is no longer supported and no official patch is provided for it. Users are advised to upgrade to version 1.5.1.7 or later if possible. Since the product is end-of-support, consider replacing the device with a supported model to ensure ongoing security updates. No temporary or alternative mitigations are documented by the vendor.