CVE-2026-113390

Summary

A command injection vulnerability exists in DrayTek Vigor2960 routers where user-supplied input is not properly sanitized before being passed to OS commands, allowing remote attackers to execute arbitrary commands with high privileges.

Exploitability

Exploitation is straightforward with remote access to the CGI interface, requiring only a single vulnerable parameter and no authentication for successful command injection.

Blast radius

The vulnerability affects all supported DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218, potentially enabling attackers to gain full system control of affected devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to firmware version 1.5.1.7 or later, as this version contains the fix for the command injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.