CVE-2026-113396: DrayTek Vigor2960 RCE Vulnerability

CVE-2026-113396 Overview

CVE-2026-113396 is a command injection vulnerability in the DrayTek Vigor2960 router running firmware version 1.5.1.6 Revision 8218. The flaw resides in the rename_table function within /cgi-bin/mainfunction.cgi, part of the Rename Table Handler component. An authenticated remote attacker can manipulate the newtable argument to inject operating system commands. Public exploit code is available, raising the practical risk of attack. The vendor notes that the Vigor2960 is end-of-sale (EoS) with limited support, and only major issues such as unauthenticated vulnerabilities will be reviewed. Upgrading to firmware version 1.5.1.7 resolves the issue. This vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component.

Critical Impact

Authenticated attackers can execute arbitrary operating system commands on affected DrayTek Vigor2960 devices through the newtable parameter, enabling potential full device compromise on an end-of-support product.

Affected Products

• DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218
• DrayTek Vigor2960 devices running firmware versions prior to 1.5.1.7
• Vigor2960 is designated end-of-sale (EoS) with limited vendor support

Discovery Timeline

• 2026-10-20 - CVE-2026-113396 published to the National Vulnerability Database (NVD)
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-113396

Vulnerability Analysis

The vulnerability resides in the rename_table function of /cgi-bin/mainfunction.cgi on the Vigor2960 web management interface. The handler accepts a user-supplied newtable argument and passes it to a downstream component without sufficient neutralization of shell metacharacters. An authenticated attacker can embed shell syntax in the newtable parameter to execute arbitrary commands under the privileges of the CGI process. Because the CGI runs on an embedded router, command injection typically yields high-privilege access to the underlying operating system. The attack is executed over the network and does not require user interaction. Public exploit material referenced as DRV2960-0013 is available in the GitHub Security Analysis on DRV2960-0013 repository.

Root Cause

The root cause is improper neutralization of special elements passed to a downstream shell or command interpreter [CWE-74]. The rename_table handler concatenates attacker-controlled input from the newtable parameter into a command string without sanitization or safe parameterization. Shell metacharacters such as ;, |, &, backticks, and $() are preserved and interpreted by the downstream shell.

Attack Vector

Exploitation requires valid authentication to the Vigor2960 web administration interface. The attacker sends a crafted HTTP request to /cgi-bin/mainfunction.cgi invoking the Rename Table Handler with a malicious newtable value. The injected command executes on the device operating system. No user interaction is required beyond the authenticated session.

// Example exploitation pattern (conceptual)
// POST /cgi-bin/mainfunction.cgi
// action=rename_table&newtable=<original_name>; <injected_command>
// Refer to the DRV2960-0013 case for a complete technical walkthrough.

Detection Methods for CVE-2026-113396

Indicators of Compromise

• HTTP POST requests to /cgi-bin/mainfunction.cgi that reference the rename_table action with unusual characters in the newtable parameter such as ;, |, &, backticks, or $().
• Unexpected outbound connections originating from the Vigor2960 management plane shortly after administrative sessions.
• New or modified system files, configuration entries, or scheduled tasks on the device following access to the Rename Table Handler.

Detection Strategies

• Inspect web server and CGI access logs for requests to /cgi-bin/mainfunction.cgi containing shell metacharacters in query or body parameters.
• Deploy IDS or WAF signatures that identify command injection patterns targeting the newtable argument.
• Correlate authenticated administrator logins with subsequent anomalous process execution or outbound traffic from the device.

Monitoring Recommendations

• Forward router syslog, authentication events, and HTTPS management traffic metadata to a centralized SIEM for inspection.
• Alert on administrative access to the Vigor2960 web interface from untrusted or non-management source networks.
• Baseline normal configuration-change activity on the device and alert on deviations such as unexpected rename_table calls.

How to Mitigate CVE-2026-113396

Immediate Actions Required

• Upgrade the Vigor2960 firmware to version 1.5.1.7, which resolves this issue according to the vendor.
• Restrict access to the web management interface to trusted management networks only, blocking exposure to the internet.
• Rotate administrative credentials and audit existing accounts, since exploitation requires authenticated access.
• Given the Vigor2960 is end-of-sale with limited vendor support, plan migration to a supported replacement platform.

Patch Information

DrayTek has released firmware version 1.5.1.7 that resolves this command injection. The firmware is available from the DrayTek Vigor2960 Firmware download. The vendor states that 2960 1.5.1.7 has corrected many security issues, but reiterates that the device is EoS and only major issues such as unauthenticated vulnerabilities will be reviewed going forward. Additional details are tracked at VulDB CVE-2026-113396 and VulDB Vulnerability #422672.

Workarounds

• Disable remote access to the web administration interface and restrict management to a dedicated VLAN or VPN.
• Enforce strong, unique administrator credentials and multi-factor authentication where supported to reduce the authenticated attack surface.
• Place the device behind a filtering gateway that inspects and blocks shell metacharacters in parameters sent to /cgi-bin/mainfunction.cgi.
• Decommission unsupported Vigor2960 units where feasible, as this vulnerability affects a product no longer actively maintained.

# Example management-plane access restriction (conceptual)
# Limit router web admin to a trusted management subnet only
# access-list MGMT permit tcp 10.0.0.0/24 any eq 443
# access-list MGMT deny tcp any any eq 443