{"id":"CVE-2026-113390","published":"2026-10-20T13:16:40.463","lastModified":"2026-10-22T22:18:03.607","description":"A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-113390","tags":[]},{"url":"https://vuldb.com/submit/992224","tags":[]},{"url":"https://vuldb.com/vuln/422666","tags":[]},{"url":"https://vuldb.com/vuln/422666/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in DrayTek Vigor2960 routers where user-supplied input is not properly sanitized before being passed to OS commands, allowing remote attackers to execute arbitrary commands with high privileges.","exploitability":"Exploitation is straightforward with remote access to the CGI interface, requiring only a single vulnerable parameter and no authentication for successful command injection.","blast_radius":"The vulnerability affects all supported DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218, potentially enabling attackers to gain full system control of affected devices.","remediation":"Upgrade to firmware version 1.5.1.7 or later, as this version contains the fix for the command injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","command-injection","network","router"],"model":"garnet-coder","analyzedAt":"2026-10-21T01:19:10.509Z"}}