Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
CVE-2026-113393 Overview
CVE-2026-113393 is an unrestricted file upload vulnerability in the DrayTek Vigor2960 router running firmware version 1.5.1.6 Revision 8218. The flaw resides in the commonupload component accessed through /cgi-bin/mainfunction.cgi. Attackers can manipulate the upload_path and upload_name arguments to write arbitrary files to the device. The attack is network-reachable and requires only low-privilege authentication. The exploit has been publicly disclosed. DrayTek has released firmware 1.5.1.7 to address the issue, but the Vigor2960 line is End-of-Sale with limited support.
Critical Impact
Authenticated remote attackers can clobber arbitrary files on affected DrayTek Vigor2960 devices, enabling tampering with device state and potential follow-on compromise.
Affected Products
- DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218
- Component: commonupload via /cgi-bin/mainfunction.cgi
- Product line is End-of-Sale with limited vendor support
Discovery Timeline
- 2026-10-20 - CVE CVE-2026-113393 published to NVD
- 2026-10-20 - Last updated in NVD database
Technical Details for CVE-2026-113393
Vulnerability Analysis
The vulnerability resides in the commonupload handler of /cgi-bin/mainfunction.cgi on DrayTek Vigor2960 firmware 1.5.1.6. The CGI handler fails to properly restrict file upload destinations and names. By manipulating the upload_path and upload_name request arguments, an authenticated attacker can direct uploaded content to arbitrary filesystem locations. This behavior is classified under [CWE-284: Improper Access Control]. The GitHub advisory tracks the issue as DRV2960-0010-authenticated-commonupload-arbitrary-file-clobber, describing it as an authenticated arbitrary file clobber primitive.
Root Cause
The commonupload endpoint accepts user-controlled values for the upload destination path and target filename without applying restrictions or validation. The handler does not enforce an allow-list of permitted directories, nor does it sanitize path components. As a result, an attacker-supplied upload_path is honored directly, allowing writes outside intended upload directories.
Attack Vector
Exploitation requires network access to the router's web management interface and a valid low-privilege account. The attacker issues a crafted POST request to /cgi-bin/mainfunction.cgi targeting the commonupload function. The request supplies attacker-controlled upload_path and upload_name parameters alongside arbitrary file content. The server writes the file to the attacker-specified location, overwriting existing files where write permissions allow. For technical specifics, refer to the GitHub Security Analysis: DrayTek case notes.
No verified exploit code is published for inclusion here. See the linked analysis repository for proof-of-concept material.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-113393
Indicators of Compromise
- POST requests to /cgi-bin/mainfunction.cgi containing the commonupload action with unusual upload_path or upload_name values
- Unexpected files appearing in system directories outside the standard upload storage area
- Modified or replaced CGI, configuration, or script files on the device filesystem
- Authenticated web sessions originating from unexpected source IPs performing upload operations
Detection Strategies
- Inspect router web server access logs for commonupload requests referencing path separators or absolute paths in upload_path
- Compare file hashes of critical device paths against a known-good firmware baseline
- Monitor for authentication events on low-privilege accounts followed immediately by file upload actions
Monitoring Recommendations
- Forward DrayTek syslog output to a central SIEM for retention and correlation
- Alert on administrative interface access from outside approved management networks
- Track firmware integrity and configuration changes on End-of-Sale devices with heightened scrutiny
How to Mitigate CVE-2026-113393
Immediate Actions Required
- Upgrade affected Vigor2960 devices to firmware version 1.5.1.7 or later
- Restrict access to the router's web management interface to trusted management networks only
- Rotate all local device credentials, prioritizing low-privilege accounts that can authenticate to the web UI
- Plan replacement of the Vigor2960 given its End-of-Sale status and limited vendor support
Patch Information
DrayTek has published firmware 1.5.1.7, which the vendor states corrects multiple security issues on the Vigor2960. Download the firmware from the official DrayTek Vigor2960 Firmware distribution point. The vendor has indicated that only major issues such as unauthenticated vulnerabilities will be reviewed going forward for this End-of-Sale product line. Additional advisory metadata is tracked at VulDB CVE-2026-113393.
Workarounds
- Disable remote (WAN-side) access to the web administration interface
- Enforce network ACLs so only designated administrator hosts can reach the management service
- Audit and remove unused low-privilege accounts to reduce the authenticated attack surface
- Place the device behind a jump host or VPN for all administrative operations
# Example: restrict management access to a trusted subnet via upstream firewall
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d <router_ip> --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
Sources: National Vulnerability Database, CISA KEV, Exploit-DB
