DrayTek Vigor2960 CVE-2026-113397

Requires valid low-privilege authenticated access (CVSS PR:L) to the Vigor2960 web management interface; the attacker then manipulates the 'option' argument passed to the ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler component) to inject OS commands. Exploitation is limited to the DrayTek Vigor2960 running the affected firmware 1.5.1.6 Revision 8218; upgrading to 1.5.1.7 remediates it. The principal limiting factor is the authentication requirement - an attacker must already possess or obtain management credentials or a valid session; no user interaction is required.

This is a moderate, not top-tier, priority. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms remote, low-complexity exploitation but requires authentication (PR:L), which meaningfully constrains the attacker population versus an unauthenticated flaw - the published exploit path itself is labeled 'authenticated-request-certificate-command-injection,' corroborating the PR:L metric. The vendor-assigned base score of 5.3 rests on uniformly Low impact metrics (VC:L/VI:L/VA:L), which is notably conservative for a CWE-77 OS command injection, where successful exploitation typically yields full command execution; this is a conflict worth flagging - the impact ratings appear understated relative to the vulnerability class, so defenders should treat realized impact as potentially higher than the 5.3 suggests. Exploit maturity is E:P (proof-of-concept), and a public POC exists on GitHub, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - this reads as a disclosed, reproducible bug rather than a mass-exploited threat. The affected product is explicitly End-of-Service, so no further fixes beyond 1.5.1.7 should be expected for non-major issues, shifting the burden to upgrade or replacement.

An attacker with valid low-privilege credentials to the Vigor2960 web management interface sends a crafted request to /cgi-bin/mainfunction.cgi invoking the ruequest_certificate function and injects shell metacharacters into the 'option' argument, causing arbitrary OS commands to run on the router. A public proof-of-concept exists, lowering the barrier to reproduction. Because the vector is network-based with low complexity, exploitation is straightforward once an authenticated session or credentials are obtained.