Skip to content
Heist/ feed
Critical

DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection

Type: advisorySource: Official CVE List1 source record

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Announced Source revision 1
Original source ↗

CVE-2026-113389

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-113389

Vigor2960

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "DrayTek",
    "modules": [
      "CGI Process"
    ],
    "product": "Vigor2960",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.1.6 Revision 8218"
      }
    ]
  }
]
Related CVEs
CVE-2026-113389

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#42177 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement