CVE-2026-113390 | DrayTek Vigor2960 1.5.1.6 Revision 8218 CGI Interface mainfunction.cgi sub_182B0 usefile/usescript/option os command injection

October 20, 2026 Yanac

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. It has been classified as very critical. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is registered as CVE-2026-113390. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

The vendor explains: “2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)”.VulDB Recent EntriesRead More