DrayTek Vigor2960 CVE-2026-113389

Exploitation requires authenticated access to the Vigor2960 web management interface with at least a low-privileged account (CVSS PR:L; the public PoC is explicitly an 'authenticated' case), plus network reachability to the HTTP(S) management service exposing /cgi-bin/mainfunction.cgi. The concrete trigger is manipulation of the 'sectiontype' argument passed to the set_table function, which reaches an OS shell unsanitized. Limiting factors that reduce real-world risk: valid credentials are mandatory (not anonymous/remote-unauthenticated), the management interface must be reachable by the attacker (internet-exposed admin panels greatly increase exposure; LAN-only reduces it), and the affected product is a single EoS firmware (Vigor2960 1.5.1.6 Rev 8218) that organizations are advised to replace rather than patch.

Multiple signals must be weighed carefully here. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) yields a base score of 8.6 (High) and indicates a network-reachable, low-complexity attack requiring low-level privileges (PR:L) - i.e. an authenticated attacker, not an anonymous remote one. A public POC exists (VulDB-referenced GitHub case DRV2960-0006), and the exploit code itself is explicitly labeled 'authenticated-set-table-command-injection', which corroborates the PR:L authentication requirement rather than contradicting it. Exploitation status is best characterized as 'publicly available exploit code exists' - there is NO CISA KEV listing and NO evidence of active in-the-wild exploitation, so this should not be treated as a confirmed exploited zero-day. No EPSS score was supplied in the input, so probabilistic exploitation likelihood cannot be quantified. The embedded SSVC-style signal E:P (Proof-of-Concept) is consistent with POC-only, not active attack. The most important risk-tempering fact is that this product is End-of-Service: the vendor states the Vigor2960 is EoS with only major (notably unauthenticated) issues reviewed, and 1.5.1.7 already addressed many issues - so an authenticated-only flaw on an EoS device is a real but bounded priority. Net assessment: a genuine high-severity, fully-exploitable issue for anyone running this legacy router with exposed management, but the authentication precondition and niche/retired product footprint make it targeted rather than mass-exploitable. The 8.6 is credible but reflects device-total compromise impact more than ease of access.

An attacker who already possesses low-privileged credentials to the Vigor2960 web management interface (or obtains them via default/weak passwords or phishing) sends a crafted request to /cgi-bin/mainfunction.cgi invoking the set_table function with a malicious sectiontype argument. Because the parameter is passed unsanitized into a shell context (CWE-77), injected OS commands execute on the router, yielding full device control. A public proof-of-concept for this exact authenticated set_table command injection is available on GitHub, lowering the skill barrier to exploitation.