DrayTek Vigor2960 Critical Remote Code Execution Flaw Lacks Active Vendor Support

DrayTek Vigor2960 routers running version 1.5.1.6 Revision 8218 are vulnerable to a critical remote command injection flaw identified as CVE-2026-113390. The National Vulnerability Database assigns this issue a CVSS score of 9.4, classifying it as critical. Attackers can exploit this vulnerability remotely by manipulating specific arguments within the CGI Interface component. This allows for unauthorized operating system command execution on affected devices.

How it unfolded

• Researchers identified a command injection flaw in the sub_182B0 function of the mainfunction.cgi file.
• The National Vulnerability Database published records for CVE-2026-113390, detailing the remote exploitation risk.
• DrayTek stated that version 1.5.1.7 has corrected many security issues.
• The vendor clarified that the Vigor2960 model is now end-of-life with limited support scope.

Who is affected

The vulnerability specifically impacts DrayTek Vigor2960 devices operating on firmware version 1.5.1.6 Revision 8218. According to the source material, this vulnerability only affects products that are no longer supported by the maintainer. The issue resides in the CGI Interface component, specifically within the handling of usefile, usescript, and option arguments. Because the exploit code has been published, the risk of automated scanning and exploitation is elevated for any exposed instances of this specific firmware version.

Our take on the response

DrayTek’s statement indicates that version 1.5.1.7 has corrected many security issues. However, the vendor explicitly states that the Vigor2960 is end-of-life and receives only limited support. This means that while a technical update exists in the 1.5.1.7 release, the vendor may not provide further patches or security updates for this hardware line going forward. Organizations must weigh the risk of running unpatched legacy equipment against the availability of this corrective release.

Who needs to act first

Managed service providers should prioritize identifying Vigor2960 devices running version 1.5.1.6 Revision 8218 across client networks. Teams usually begin by isolating internet-facing instances of this hardware to reduce immediate exposure. Verify whether the 1.5.1.7 firmware is compatible with current client configurations before deploying updates. Since the vendor has declared this model end-of-life, organizations should evaluate replacing these devices with supported alternatives. Document all affected assets and ensure backup procedures are in place before applying any firmware changes to prevent service disruption.

What to do and how to stay safe: DrayTek

• Audit network inventory to locate all DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218.
• Apply the 1.5.1.7 firmware update to patch the command injection vulnerability if hardware compatibility allows.
• Implement network segmentation to restrict direct internet access to legacy router management interfaces.
• Monitor traffic logs for suspicious activity targeting the mainfunction.cgi endpoint on affected devices.

Step-by-step guide: Vulnerability Prioritization: How to Rank Risks Without Wasting Time

General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which specific DrayTek product and version is affected by CVE-2026-113390?

The vulnerability affects DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218.

Is there a patch available to fix this critical vulnerability?

DrayTek states that version 1.5.1.7 has corrected many security issues.

Does DrayTek still provide regular security updates for the Vigor2960?

No, the vendor has declared the Vigor2960 end-of-life, offering only limited support for major issues.