Key points
- DrayTek Vigor2960 version 1.5.1.6 Revision 8218 is affected by CVE-2026-113391.
- The National Vulnerability Database rates the flaw as critical with a CVSS score of 9.4.
- Upgrading to firmware version 1.5.1.7 resolves the issue.
DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218 are vulnerable to a critical security flaw. The National Vulnerability Database identifies this issue as CVE-2026-113391. Attackers can exploit this weakness remotely to inject commands into the system. A patch is available for those who can apply it.
In plain English
The vulnerability exists in the upload function of the router’s web interface. Specifically, it affects the uploadlangs function within the mainfunction.cgi file. Flaws related to improper neutralization of input allow command injection. This means an attacker can send malicious data to the upload endpoint. The system then executes these commands instead of just saving a file.
The background
This flaw carries a CVSS score of 9.4, which is classified as critical. The National Vulnerability Database also lists a related assessment with a score of 8.6, rated high. Both ratings cite weaknesses CWE-77 and CWE-74. The exploit details have been disclosed to the public. This disclosure indicates that the methods to abuse the flaw are known and may be used by threat actors.
What changes now
DrayTek has released firmware version 1.5.1.7 to address this issue. The vendor states this update corrects many security issues. However, the Vigor2960 series is at end-of-service. Support is now limited to major issues, such as unauthenticated vulnerabilities. Users must apply this update to mitigate the risk.
Who needs to act first
Teams should prioritize updating devices that face the internet directly. Check your network diagrams to find exposed endpoints. Before applying the firmware, create a full backup of the current configuration. This ensures you can restore settings if the update fails. Test the new version on a single device first. Verify that basic connectivity and logging functions remain intact. Roll out the fix to the rest of the fleet only after successful testing. Document the change for audit purposes. Monitor logs for unusual activity during the transition period.
What to do and how to stay safe: DrayTek
- Verify if your Vigor2960 routers are running version 1.5.1.6 Revision 8218.
- Download and install firmware version 1.5.1.7 from the vendor's site.
- Review firewall logs for signs of exploitation attempts or unusual traffic.
- Consider replacing unsupported hardware if security risks remain unacceptable.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a patch for CVE-2026-113391?
Yes, upgrading to DrayTek Vigor2960 firmware version 1.5.1.7 mitigates the vulnerability.
Does this affect supported DrayTek products?
No, this vulnerability only affects the Vigor2960, which is no longer supported by the maintainer.
How severe is this flaw?
The National Vulnerability Database rates it as critical with a CVSS score of 9.4.
