Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113390 Overview
CVE-2026-113390 is an operating system command injection vulnerability in the DrayTek Vigor2960 router, firmware version 1.5.1.6 Revision 8218. The flaw resides in the sub_182B0 function within /cgi-bin/mainfunction.cgi, part of the device's CGI interface. Attackers can manipulate the usefile, usescript, or option arguments to inject arbitrary operating system commands. Remote exploitation is possible, and a public exploit has been published. The vendor states that firmware 2960 1.5.1.7 corrects multiple security issues, but confirms the Vigor2960 is End-of-Sale with limited support. The vulnerability is tracked under CWE-77 and only affects products no longer supported by the maintainer.
Critical Impact
Authenticated remote attackers can execute arbitrary operating system commands on unsupported Vigor2960 appliances, leading to full device compromise and lateral network access.
Affected Products
- DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218
- DrayTek Vigor2960 appliance (End-of-Sale, limited vendor support)
- CGI Interface component: /cgi-bin/mainfunction.cgi
Discovery Timeline
- 2026-10-20 - CVE-2026-113390 published to the National Vulnerability Database
- 2026-10-22 - Last updated in NVD database
Technical Details for CVE-2026-113390
Vulnerability Analysis
The vulnerability resides in the sub_182B0 function of the /cgi-bin/mainfunction.cgi binary on DrayTek Vigor2960 routers. The function processes the request parameters usefile, usescript, and option without applying sufficient input sanitization. User-controlled values flow into a command execution context, allowing shell metacharacters to break out of the intended command string. An authenticated attacker reaching the CGI endpoint over the network can inject arbitrary operating system commands that execute with the privileges of the web management process.
Successful exploitation yields command execution on the embedded Linux operating system that powers the Vigor2960. Attackers can read configuration files, pivot into internal networks, deploy persistence, or disable security controls. Because the device is End-of-Sale, affected deployments will not receive routine security maintenance from the vendor.
Root Cause
The root cause is improper neutralization of special elements used in an OS command [CWE-77]. The sub_182B0 handler concatenates attacker-controlled parameters into a shell command without escaping or whitelisting characters such as ;, |, `, or $(). This classic command injection pattern allows arbitrary shell execution.
Attack Vector
Exploitation requires network access to the device management interface and valid low-privilege credentials. The attacker issues an HTTP request to /cgi-bin/mainfunction.cgi and embeds shell metacharacters in the usefile, usescript, or option parameter. The CGI binary parses the request, invokes sub_182B0, and executes the injected payload. A public exploit has been published, as documented in the DrayTek Vigor2960 Security Analysis repository.
No verified sanitized exploit code is included here. Readers should consult the referenced technical analysis for request structure and payload details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113390
Indicators of Compromise
- HTTP requests to /cgi-bin/mainfunction.cgi containing shell metacharacters (;, |, &, `, $()) in the usefile, usescript, or option parameters.
- Unexpected outbound connections from the Vigor2960 management interface to attacker-controlled hosts.
- New or modified files on the router's filesystem following suspicious management-plane requests.
- Authenticated management sessions originating from untrusted IP ranges immediately preceding anomalous CGI traffic.
Detection Strategies
- Deploy network intrusion detection signatures that inspect HTTP request bodies and query strings targeting mainfunction.cgi for command injection patterns.
- Correlate authentication events on the Vigor2960 with subsequent CGI parameter anomalies to identify abuse of low-privilege accounts.
- Baseline normal administrative traffic to the router and flag deviations in request structure, user agents, or source IPs.
Monitoring Recommendations
- Forward router syslog, HTTP management logs, and NetFlow data to a centralized log platform for correlation.
- Monitor for process execution anomalies and unexpected outbound traffic from edge appliances that typically only serve routing functions.
- Review web management logs for repeated 4xx or 5xx responses on mainfunction.cgi, which may indicate payload tuning by an attacker.
How to Mitigate CVE-2026-113390
Immediate Actions Required
- Restrict access to the Vigor2960 web management interface to trusted management networks only. Block administrative access from the WAN.
- Rotate all administrative credentials on affected devices and enforce strong, unique passwords.
- Audit device configuration and logs for signs of prior exploitation, including unauthorized firmware changes or new scheduled tasks.
- Plan replacement of End-of-Sale Vigor2960 units with a supported appliance that receives active security maintenance.
Patch Information
The vendor states that Vigor2960 firmware 1.5.1.7 corrects multiple security issues. However, DrayTek has designated the Vigor2960 as End-of-Sale with limited support, and only major unauthenticated vulnerabilities will be reviewed going forward. Administrators should verify current firmware against the latest vendor release and consult the VulDB entry for CVE-2026-113390 for status updates.
Workarounds
- Disable remote administration on the WAN interface and permit management only from a dedicated internal VLAN.
- Place the device behind a reverse proxy or VPN concentrator that enforces strong authentication before exposing the management plane.
- Apply strict access control lists (ACLs) limiting the source IP addresses allowed to reach /cgi-bin/mainfunction.cgi.
- Decommission unsupported DrayTek Vigor2960 devices where feasible and migrate to a currently supported platform.
# Example: restrict router management access to a trusted subnet
# (adapt to your firewall syntax)
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
