DrayTek Releases Patch for Critical RCE in End-of-Support Vigor2960 Router

DrayTek has issued a firmware update for its Vigor2960 routers to address a critical remote command injection vulnerability. The flaw, tracked as CVE-2026-113391, affects systems running version 1.5.1.6 Revision 8218 and allows attackers to execute commands remotely.

What happened

A vulnerability was identified in the uploadlangs function of the /cgi-bin/mainfunction.cgi component on DrayTek Vigor2960 routers. According to the National Vulnerability Database, this flaw exists in version 1.5.1.6 Revision 8218 and enables command injection through the upload endpoint. The National Vulnerability Database rates the severity of CVE-2026-113391 as critical with a CVSS score of 9.4.

The exploit code for this vulnerability has been disclosed to the public, meaning attackers can use it immediately. DrayTek responded by releasing firmware version 1.5.1.7, which corrects this issue along with many other security problems. The vendor noted that this update was provided despite the Vigor2960 being an end-of-support product, as the flaw was an unauthenticated vulnerability.

Why it matters

This incident highlights the risks of maintaining end-of-support hardware in active network environments. The Vigor2960 is no longer supported by DrayTek, meaning only major issues like unauthenticated vulnerabilities receive attention. The public disclosure of the exploit increases the likelihood of automated scanning and targeted attacks against exposed devices.

Administrators must recognize that the affected version, 1.5.1.6 Revision 8218, is vulnerable to remote command injection. The weakness involves improper neutralization of special elements in OS commands, mapped to CWE-77 and CWE-74. Because the attack can be executed remotely, any device accessible from the internet is at immediate risk of compromise.

What to watch

• Monitor network logs for unusual activity originating from or targeting Vigor2960 routers.
• Check for unauthorized changes to system configurations or new user accounts on affected devices.
• Watch for public releases of additional exploit tools or proof-of-concept code related to CVE-2026-113391.
• Verify that all Vigor2960 units have been updated to version 1.5.1.7 or later to mitigate the known risk.

Who needs to act first

Teams should prioritize updating any Vigor2960 routers that are directly accessible from the internet or untrusted networks. Before applying the firmware update, administrators should back up current configurations to prevent data loss during the process. If a device cannot be updated immediately, isolate it from external networks to reduce exposure. Verify the integrity of the firmware file before installation to ensure it has not been tampered with.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: DrayTek

• Identify all Vigor2960 routers in your environment running version 1.5.1.6 Revision 8218.
• Download and install firmware version 1.5.1.7 from the official DrayTek support channel.
• Restrict remote management access to trusted IP addresses using firewall rules until updates are verified.
• Review system logs for signs of exploitation attempts, such as unexpected command executions or failed login spikes.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which DrayTek router models are affected by CVE-2026-113391?

Only the DrayTek Vigor2960 running firmware version 1.5.1.6 Revision 8218 is affected by this specific vulnerability.

Is there a patch available for this critical remote command injection flaw?

Yes, DrayTek has released firmware version 1.5.1.7, which mitigates this issue and corrects many other security problems.

Why did DrayTek release a fix for an end-of-support product?

The vendor stated that the Vigor2960 is end-of-support with limited support, but major issues like unauthenticated vulnerabilities are still reviewed and addressed.