{"id":"CVE-2026-113389","published":"2026-10-20T12:17:29.443","lastModified":"2026-10-20T19:27:34.430","description":"A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-74","CWE-77"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-113389","tags":[]},{"url":"https://vuldb.com/submit/992223","tags":[]},{"url":"https://vuldb.com/vuln/422665","tags":[]},{"url":"https://vuldb.com/vuln/422665/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in DrayTek Vigor2960 routers where user-supplied input in the 'sectiontype' parameter of /cgi-bin/mainfunction.cgi can execute arbitrary commands with high privileges. This allows attackers to gain full control of the device remotely.","exploitability":"Exploitation is straightforward with no authentication required, leveraging a remote command injection vulnerability that can be triggered via a single HTTP request to the affected CGI endpoint.","blast_radius":"The vulnerability affects all supported DrayTek Vigor2960 models running firmware version 1.5.1.6 Revision 8218, potentially compromising thousands of network devices in enterprise and home environments.","remediation":"Upgrade to firmware version 1.5.1.7 or later immediately, as this is the first fixed version released by the vendor to address this critical vulnerability.","detection":"Monitor for unusual HTTP GET requests to /cgi-bin/mainfunction.cgi with suspicious command injection payloads in the sectiontype parameter, particularly those containing shell metacharacters like semicolons or pipes.","tags":["rce","web","network","router"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:19:00.884Z"}}