CVE-2026-113389

Summary

A command injection vulnerability exists in DrayTek Vigor2960 routers where user-supplied input in the 'sectiontype' parameter of /cgi-bin/mainfunction.cgi can execute arbitrary commands with high privileges. This allows attackers to gain full control of the device remotely.

Exploitability

Exploitation is straightforward with no authentication required, leveraging a remote command injection vulnerability that can be triggered via a single HTTP request to the affected CGI endpoint.

Blast radius

The vulnerability affects all supported DrayTek Vigor2960 models running firmware version 1.5.1.6 Revision 8218, potentially compromising thousands of network devices in enterprise and home environments.

Detection

Monitor for unusual HTTP GET requests to /cgi-bin/mainfunction.cgi with suspicious command injection payloads in the sectiontype parameter, particularly those containing shell metacharacters like semicolons or pipes.

Prioritized remediation

Upgrade to firmware version 1.5.1.7 or later immediately, as this is the first fixed version released by the vendor to address this critical vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.