CVE-2026-113393 | DrayTek Vigor2960 1.5.1.6 Revision 8218 commonupload mainfunction.cgi upload_path/upload_name unrestricted upload

October 20, 2026 Yanac

A vulnerability categorized as critical has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability appears as CVE-2026-113393. The attack may be performed from remote. In addition, an exploit is available.

It is advisable to upgrade the affected component.

The vendor explains: “2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)”.VulDB Recent EntriesRead More