DrayTek Vigor2960 CVE-2026-113391

Exploitation requires (1) network reachability to the Vigor2960 web administration interface hosting /cgi-bin/mainfunction.cgi, and (2) valid authenticated access at least at low privilege (CVSS PR:L; the public exploit is explicitly the authenticated upload-filename command injection), after which a crafted upload filename containing shell metacharacters triggers the uploadlangs command injection. LIMITING FACTORS: this is NOT unauthenticated - an attacker needs working credentials, so devices that do not expose the management interface to untrusted networks and that use strong, non-default credentials are substantially harder to exploit; the vulnerable product is also End-of-Sale, and the issue affects only the unsupported Vigor2960 line running firmware at/around 1.5.1.6 Revision 8218 (mitigated by upgrading to 1.5.1.7).

Multiple signals point to a genuine but conditional priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity command injection requiring only low-level authentication (PR:L), with high confidentiality, integrity, and availability impact - a realistic path to full device compromise. A public exploit exists (confirmed by VulDB and a GitHub PoC), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active, widespread exploitation at this time - PoC availability and active exploitation are distinct signals. The critical caveat: the exploit reference and function name ('authenticated-upload-filename-command-injection') confirm this is a post-authentication flaw (consistent with PR:L), NOT unauthenticated RCE, which materially lowers real-world exposure for devices whose management interface is not exposed with weak/default credentials. A conflicting/limiting factor worth flagging: the vendor states the Vigor2960 is End-of-Sale with only limited support, and this vulnerability only affects an unsupported product - meaning deployment is declining but patched firmware (1.5.1.7) is still available. Net assessment: a real, exploitable, high-impact vulnerability that should be prioritized where Vigor2960 devices remain in service, but the authentication requirement and EoS status temper it below drop-everything urgency absent evidence of exploitation in the wild.

An attacker who holds valid (even low-privilege) credentials to the Vigor2960 web management interface reaches the uploadlangs function in /cgi-bin/mainfunction.cgi and submits a crafted upload whose filename contains shell metacharacters, injecting OS commands that execute on the router. A public proof-of-concept exists demonstrating the authenticated upload-filename command injection, lowering the skill needed to weaponize it. Given AV:N/AC:L, exploitation is straightforward once network access to the management interface and credentials are obtained.