{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-113390/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:draytek:vigor2960:1.5.1.6:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-113389"},{"cvss":9.9,"id":"CVE-2026-113391"},{"cvss":9.9,"id":"CVE-2026-113390"},{"cvss":7.4,"id":"CVE-2026-113395"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-113391\u0026utm_source=rss\u0026utm_medium=rss","https://sploitus.com/exploit?id=CVE-2026-113389\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Vigor2960 (1.5.1.6 Revision 8218)","Vigor2960 (\u003c= 1.5.1.6 Revision 8218)"],"_cs_severities":["critical"],"_cs_tags":["network-device","command-injection","vulnerability","cve-2026-113389","cve-2026-113390","remote-code-execution","network-infrastructure"],"_cs_type":"advisory","_cs_vendors":["DrayTek"],"content_html":"\u003cp\u003eDrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 contains a critical command injection vulnerability (CVE-2026-113389) residing within the set_table function of the /cgi-bin/mainfunction.cgi script. An unauthenticated remote attacker can exploit this flaw by manipulating the sectiontype argument, leading to arbitrary command execution on the affected network device. The vendor has identified this issue and released firmware version 1.5.1.7. However, the Vigor2960 product line has reached End-of-Life (EoS) status, meaning manufacturer support is extremely limited, and security updates are only provided for critical, unauthenticated vulnerabilities. The vulnerability is publicly disclosed, necessitating immediate action for administrators operating this hardware.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for full remote system compromise, enabling attackers to gain unauthorized access to internal network traffic, modify device configurations, or leverage the router as a pivot point for lateral movement into protected internal segments. Given that the Vigor2960 is an edge device, the risk of perimeter breach is high.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch affected Vigor2960 devices to firmware version 1.5.1.7 immediately.\u003c/li\u003e\n\u003cli\u003eEvaluate the retirement of Vigor2960 devices from the network infrastructure due to EoS status and limited security support.\u003c/li\u003e\n\u003cli\u003eMonitor webserver access logs for anomalous POST requests directed at /cgi-bin/mainfunction.cgi that include shell metacharacters in the sectiontype query parameter.\u003c/li\u003e\n\u003cli\u003eRestrict management interface access to trusted internal IP addresses only.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T14:43:34Z","date_published":"2026-10-20T13:08:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-draytek-command-injection/","summary":"DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218 is vulnerable to unauthenticated remote command injection via the set_table function in mainfunction.cgi.","title":"DrayTek Vigor2960: Command injection in CGI Process (CVE-2026-113389)","url":"https://feed.craftedsignal.io/briefs/2026-10-draytek-command-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-113390","version":"https://jsonfeed.org/version/1.1"}