Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113389 Overview
CVE-2026-113389 is a command injection vulnerability in the DrayTek Vigor2960 router, firmware version 1.5.1.6 Revision 8218. The flaw resides in the set_table function of /cgi-bin/mainfunction.cgi, part of the device's CGI processing component. Attackers can manipulate the sectiontype argument to inject arbitrary operating system commands over the network. A public exploit exists, and the vendor states that the Vigor2960 line has reached end-of-service with only limited support for major unauthenticated issues. DrayTek notes that 2960 1.5.1.7 corrected many security issues, but the affected hardware remains in production environments. The vulnerability is tracked under CWE-74 (Improper Neutralization of Special Elements in Output).
Critical Impact
Authenticated remote attackers can execute arbitrary commands on the router, enabling full device compromise, pivoting into internal networks, and persistent control of edge infrastructure.
Affected Products
- DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218
- DrayTek Vigor2960 series (end-of-service hardware)
- /cgi-bin/mainfunction.cgi CGI processing component
Discovery Timeline
- 2026-10-20 - CVE-2026-113389 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-113389
Vulnerability Analysis
The vulnerability exists in the set_table handler inside /cgi-bin/mainfunction.cgi on the DrayTek Vigor2960. The handler accepts a sectiontype parameter and passes its value into a downstream shell execution context without proper neutralization. Because the input is incorporated into a command string, an attacker who supplies shell metacharacters can break out of the intended parameter boundary and append arbitrary commands. Successful exploitation yields code execution in the context of the CGI process, which on embedded DrayTek firmware typically runs with elevated privileges. The exploit is publicly documented in the DrayTek Vigor2960 Security Analysis repository.
Root Cause
The root cause is improper input neutralization [CWE-74]. The set_table function trusts the sectiontype parameter and does not sanitize shell metacharacters such as backticks, semicolons, pipes, or $() constructs before using the value in a command invocation. The firmware lacks a parameter allowlist and does not use safe process-spawning primitives that separate arguments from the shell interpreter.
Attack Vector
The attack is network-based and requires low-privilege authentication to the router's management interface. An attacker who holds any valid session can issue a crafted HTTP request to /cgi-bin/mainfunction.cgi targeting the set_table action with a weaponized sectiontype value. Because many Vigor2960 deployments expose management interfaces to adjacent networks or, in misconfigured cases, the public internet, the practical attack surface is broad. Successful exploitation permits command execution, configuration modification, credential theft, and lateral movement into protected networks behind the device.
No verified exploit code is reproduced here. Technical details and a proof of concept are available in the GitHub security analysis case DRV2960-0006 and the VulDB vulnerability report 422665.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113389
Indicators of Compromise
- HTTP POST or GET requests to /cgi-bin/mainfunction.cgi containing sectiontype values with shell metacharacters such as ;, |, `, $(, or &&.
- Unexpected outbound connections from the router to attacker-controlled infrastructure following administrative sessions.
- New or modified processes, cron entries, or firewall rules on the Vigor2960 that were not initiated by an administrator.
- Authentication log entries showing low-privilege accounts accessing set_table endpoints they do not normally use.
Detection Strategies
- Deploy network intrusion detection signatures that inspect HTTP request bodies and query strings sent to mainfunction.cgi for shell metacharacters in the sectiontype parameter.
- Correlate router administrative authentication events with subsequent anomalous outbound traffic from the device's management plane.
- Monitor DNS queries originating from the router for suspicious domains or encoded command-and-control patterns.
Monitoring Recommendations
- Forward router syslog and web management access logs to a centralized log platform for retention and search.
- Baseline normal administrative traffic patterns to /cgi-bin/mainfunction.cgi so deviations trigger alerts.
- Alert on any management interface access from untrusted source networks or from geographic regions inconsistent with your administrator base.
How to Mitigate CVE-2026-113389
Immediate Actions Required
- Remove the Vigor2960 management interface from exposure to untrusted networks, including the public internet.
- Restrict administrative access to a dedicated management VLAN with source IP allowlisting.
- Rotate all administrative credentials and disable unused accounts on the device.
- Plan replacement of the Vigor2960, which the vendor has designated end-of-service with only limited security support.
Patch Information
The vendor states that Vigor2960 firmware 1.5.1.7 corrected many security issues, but the Vigor2960 line is end-of-service and only major issues such as unauthenticated vulnerabilities will be reviewed going forward. Operators should treat the platform as unsupported and migrate to a currently maintained DrayTek model. See the VulDB CVE record for CVE-2026-113389 for ongoing vendor commentary.
Workarounds
- Disable remote management on WAN interfaces and permit administration only from trusted internal hosts.
- Place the router behind an upstream firewall that filters HTTP requests to mainfunction.cgi containing suspicious sectiontype payloads.
- Enforce strong, unique administrative passwords and enable account lockout to raise the cost of credential-based access.
- Segment the router from sensitive internal networks so a compromised device has limited lateral reach.
# Example upstream firewall rule to restrict Vigor2960 management access
# Replace 10.0.0.0/24 with your trusted management subnet
iptables -A FORWARD -p tcp -d <router-ip> --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router-ip> --dport 443 -j DROP
iptables -A FORWARD -p tcp -d <router-ip> --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
