Key points
- DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 contains a critical command injection vulnerability.
- The flaw allows remote attackers to execute arbitrary commands via the sectiontype argument.
- Public exploits are available, and the vendor states the product is officially end-of-life.
DrayTek Vigor2960 devices running firmware version 1.5.1.6 Revision 8218 are affected by a critical security vulnerability. The issue involves command injection within the CGI Process component. Specifically, the set_table function in the mainfunction.cgi file fails to properly handle the sectiontype argument. This allows remote attackers to inject and execute system commands without authentication.
In plain English
The vulnerability exists because the software does not correctly validate user input. When an attacker sends a specially crafted request, the device treats part of that request as a system command. This bypasses normal security checks. The flaw is rated critical with a CVSS score of 9.4. It enables remote command execution on the device.
The background
The vendor states that firmware version 1.5.1.7 corrected many security issues. However, DrayTek states that the Vigor2960 series is now end-of-life. Support is limited to major issues like unauthenticated vulnerabilities. The company notes that this product is no longer supported by the maintainer. Public exploits for this flaw are currently available online.
Who needs to act first
Small business owners should immediately identify any Vigor2960 devices still on the network. If these routers are exposed to the internet, they are at immediate risk. Teams usually prioritize isolating unsupported hardware from critical data networks. Administrators should verify firmware versions and disconnect affected units from external traffic. Upgrading to supported hardware is the only long-term solution for end-of-life devices.
What to do and how to stay safe: DrayTek
- Check your network inventory for DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218.
- Isolate affected devices from the internet immediately to prevent remote exploitation.
- Plan to replace end-of-life hardware with supported models that receive regular security updates.
- Monitor network logs for unusual outbound traffic that may indicate successful command injection.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for this vulnerability?
Firmware version 1.5.1.7 corrected many security issues, but the vendor states the product is end-of-life with limited support.
How severe is this vulnerability?
The National Vulnerability Database rates it as critical with a CVSS score of 9.4.
Can attackers exploit this remotely?
Yes, the vulnerability allows remote command injection without requiring user authentication.
