Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113391 Overview
CVE-2026-113391 is a command injection vulnerability in DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218. The flaw resides in the uploadlangs function within /cgi-bin/mainfunction.cgi, part of the Upload Endpoint component. An authenticated attacker can manipulate the upload filename to inject arbitrary operating system commands. The attack executes remotely over the network and the exploit has been publicly disclosed. DrayTek has released firmware version 1.5.1.7 to address the issue, but the Vigor2960 product line has reached End of Service (EoS). The vendor states that only unauthenticated vulnerabilities in the EoS line receive ongoing review.
Critical Impact
Authenticated remote attackers can execute arbitrary commands on the router operating system, enabling full device compromise, traffic interception, and pivoting into internal networks.
Affected Products
- DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218
- DrayTek Vigor2960 Upload Endpoint component (/cgi-bin/mainfunction.cgi)
- Vulnerable function: uploadlangs
Discovery Timeline
- 2026-10-20 - CVE-2026-113391 published to the National Vulnerability Database
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-113391
Vulnerability Analysis
The vulnerability is a command injection flaw [CWE-74] in the uploadlangs function of /cgi-bin/mainfunction.cgi. This CGI handler processes language file uploads on the Vigor2960 web management interface. The handler passes attacker-controlled input, specifically the upload filename, into a shell context without proper sanitization. Attackers who hold valid low-privilege web session credentials can craft a filename containing shell metacharacters to execute commands as the web server process. Because the Vigor2960 runs the vulnerable CGI with elevated privileges on the router, successful exploitation grants control over networking functions, firewall rules, and VPN tunnels. Public technical analysis of the issue is available in the DrayTek Vigor2960 Security Analysis repository.
Root Cause
The uploadlangs handler constructs a system command using the uploaded filename value without escaping or validating shell metacharacters. The absence of input neutralization allows injection of characters such as backticks, semicolons, and pipes, which the underlying shell interprets as command separators.
Attack Vector
The vulnerability is reachable over the network through the device's HTTP management interface. The attacker must first authenticate to the web console with at least low-privilege credentials. After authentication, the attacker submits a POST request to the upload endpoint with a specially crafted filename parameter containing shell metacharacters. The injected commands execute in the context of the CGI handler on the router. Public exploit details are referenced in VulDB entry 422667.
No verified exploit code is included in this article. See the GitHub security analysis case DRV2960-0008 for proof-of-concept details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113391
Indicators of Compromise
- POST requests to /cgi-bin/mainfunction.cgi invoking the uploadlangs action with filename parameters containing shell metacharacters such as ;, |, `, $(), or &&.
- Unexpected child processes spawned by the httpd or CGI handler process on the Vigor2960.
- New outbound connections from the router to unknown hosts, particularly to ports commonly used for reverse shells.
- Unauthorized modifications to router configuration, firewall rules, DNS settings, or administrative accounts.
Detection Strategies
- Inspect HTTP request logs on upstream proxies or network taps for filename fields containing non-alphanumeric characters when posted to mainfunction.cgi.
- Alert on authenticated administrative sessions originating from untrusted source IP ranges or unusual geographies.
- Correlate router configuration changes with the identity and source of the authenticated session that initiated them.
Monitoring Recommendations
- Forward Vigor2960 syslog and HTTP access logs to a centralized SIEM for retention and query.
- Enable alerting on failed and successful logins to the device management interface and on language-pack upload events.
- Monitor north-south traffic from the router itself; the device should rarely initiate arbitrary outbound sessions.
How to Mitigate CVE-2026-113391
Immediate Actions Required
- Upgrade affected Vigor2960 devices to firmware version 1.5.1.7, available from the DrayTek firmware download.
- Restrict access to the router web management interface to trusted administrative networks only; block WAN-side access.
- Rotate all administrator and operator credentials on the device, especially if management was ever exposed to untrusted networks.
- Plan replacement of the Vigor2960 given its End of Service status; the vendor will only review unauthenticated vulnerabilities going forward.
Patch Information
DrayTek released Vigor2960 firmware 1.5.1.7, which the vendor states corrects multiple security issues including this command injection. The vendor confirms the Vigor2960 is End of Service with limited support. Download the fix from the official DrayTek firmware archive. Additional vulnerability metadata is available at VulDB CVE-2026-113391.
Workarounds
- Disable remote WAN-side administration and permit management only from a dedicated LAN segment or jump host.
- Enforce strong, unique credentials for every administrative account and remove unused low-privilege accounts that could serve as a foothold for authenticated exploitation.
- Place the device behind an upstream firewall or reverse proxy that filters requests to /cgi-bin/mainfunction.cgi containing shell metacharacters in filename parameters.
- Where possible, migrate to a currently supported DrayTek platform or alternative router that still receives security updates.
# Example upstream ACL to restrict Vigor2960 management access
# Permit only the administrative subnet to reach the web UI
iptables -A FORWARD -s 10.10.0.0/24 -d 192.0.2.1 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 192.0.2.1 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
