DrayTek Vigor2960: Command injection in CGI Process (CVE-2026-113389)

DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 contains a critical command injection vulnerability (CVE-2026-113389) residing within the set_table function of the /cgi-bin/mainfunction.cgi script. An unauthenticated remote attacker can exploit this flaw by manipulating the sectiontype argument, leading to arbitrary command execution on the affected network device. The vendor has identified this issue and released firmware version 1.5.1.7. However, the Vigor2960 product line has reached End-of-Life (EoS) status, meaning manufacturer support is extremely limited, and security updates are only provided for critical, unauthenticated vulnerabilities. The vulnerability is publicly disclosed, necessitating immediate action for administrators operating this hardware.

Impact

Successful exploitation allows for full remote system compromise, enabling attackers to gain unauthorized access to internal network traffic, modify device configurations, or leverage the router as a pivot point for lateral movement into protected internal segments. Given that the Vigor2960 is an edge device, the risk of perimeter breach is high.

Recommendation

• Patch affected Vigor2960 devices to firmware version 1.5.1.7 immediately.
• Evaluate the retirement of Vigor2960 devices from the network infrastructure due to EoS status and limited security support.
• Monitor webserver access logs for anomalous POST requests directed at /cgi-bin/mainfunction.cgi that include shell metacharacters in the sectiontype query parameter.
• Restrict management interface access to trusted internal IP addresses only.