CVE-2026-113397 | DrayTek Vigor2960 1.5.1.6 Revision 8218 IPsec mainfunction.cgi ruequest_certificate option command injection

October 20, 2026 Yanac

A vulnerability described as critical has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is uniquely identified as CVE-2026-113397. The attack can be launched remotely. Moreover, an exploit is present.

Upgrading the affected component is recommended.

The vendor explains: “2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)”.VulDB Recent EntriesRead More