CVE-2026-113391

Summary

A command injection vulnerability exists in DrayTek Vigor2960 routers in the uploadlangs function of /cgi-bin/mainfunction.cgi, allowing remote attackers with low privileges to execute arbitrary commands on the device. This critical flaw affects unsupported products and can lead to complete device compromise.

Exploitability

The vulnerability is easily exploitable with minimal preconditions, requiring only a network connection to the affected router's web interface and authentication credentials.

Blast radius

If exploited, this vulnerability could allow attackers to gain full control of the router, potentially leading to network infiltration, data exfiltration, or as a pivot point for attacks on other network devices.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.5.1.7 immediately, as this is the specific fixed version mentioned in the vendor advisory for the DrayTek Vigor2960 router.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.