EUVD-2026-104988
GHSA-r5pp-rj98-9f7m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-priv web credentials
-
DeliverySend crafted request to mainfunction.cgi
-
ExploitInject shell metacharacters via usefile/usescript/option
-
ExecutionOS command execution in sub_182B0
-
ImpactFull router compromise as privileged user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated, low-privilege session to the DrayTek Vigor2960 web management interface (per CVSS PR:L and the 'authenticated' PoC case), from which the attacker reaches /cgi-bin/mainfunction.cgi and supplies malicious shell input in the usefile, usescript, or option arguments handled by function sub_182B0. Limiting factors: valid credentials and network reachability to the HTTP management interface are mandatory (not exploitable pre-auth), and only firmware 1.5.1.6 Revision 8218 is named - the vendor indicates 1.5.1.7 corrected security issues. Because the device is End-of-Service, exposure is largely confined to legacy deployments still running the vulnerable build with the admin interface accessible. |
| Impact | This is a credible operational risk but not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-privilege authentication, with high confidentiality, integrity and availability impact - consistent with CWE-78 OS command injection on an embedded router. A public exploit exists (VulDB; GitHub PoC), and the PoC is explicitly 'authenticated,' which aligns with PR:L rather than PR:N. Two signals moderate the raw 8.6 score: (1) exploitation requires valid credentials to the web management interface, so it is not a drive-by unauthenticated RCE; and (2) the product is End-of-Service and niche, limiting the exploitable population. The vendor notably states 2960 EoS will only review unauthenticated issues, implying this authenticated flaw may not receive a dedicated fix beyond the pre-existing 1.5.1.7. No EPSS score was provided and the CVE is NOT listed in CISA KEV, so there is no evidence of active in-the-wild exploitation despite PoC availability - do not conflate the two. Net: prioritize for exposed/EoS DrayTek 2960 fleets where the management interface is reachable, but treat as high-not-critical given the authentication precondition and EoS status. |
| Exploit ScenarioDerived | An attacker with low-privilege credentials to the Vigor2960 web interface sends a crafted request to /cgi-bin/mainfunction.cgi, injecting shell metacharacters into the usefile, usescript, or option parameters processed by sub_182B0. Because input is passed to an OS command without sanitization, the injected commands execute on the device (typically as root on such embedded appliances), yielding full device compromise. A public PoC for the authenticated jsonstatus/usefile file-clobber case has been published and may be reused. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 20, 2026
OS command injection in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 allows authenticated, low-privilege attackers to execute arbitrary shell commands on the device through the web management interface. The flaw resides in the CGI handler /cgi-bin/mainfunction.cgi (function sub_182B0), where the usefile, usescript, and option parameters are passed to a shell without adequate sanitization. Publicly available exploit code exists, and the vendor has classified the Vigor2960 as End-of-Service with only limited support, so legacy deployments exposing the management interface are the primary exposure.
Earlier versions of this analysis (1)
OS command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated remote attacker to execute arbitrary OS commands through the web management CGI interface's usefile/usescript/option parameters. Publicly available exploit code exists, and the referenced GitHub case is explicitly authenticated, matching the assessed CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The product is end-of-support, and no CISA KEV confirmation of active mass exploitation was provided.
RemediationAI
The vendor states that firmware 1.5.1.7 corrects many security issues, so upgrading from 1.5.1.6 Revision 8218 to 1.5.1.7 or later is the primary fix where the device remains in service; however, the Vigor2960 is End-of-Service, so the durable remediation is to replace it with a supported DrayTek model or another maintained router. Because the vulnerability requires an authenticated session and publicly available exploit code exists, immediately restrict administrative access: block the web management interface from WAN and untrusted networks, permit only a dedicated management VLAN or explicit allowlist, disable remote management features, enforce strong unique credentials and MFA where supported, and monitor /cgi-bin/mainfunction.cgi requests for suspicious usefile, usescript, or option values. The trade-off is reduced remote-admin convenience; if out-of-band management is required, use a VPN or jump host rather than exposing the UI. Vendor advisories and technical details are available at https://vuldb.com/vuln/422666 and the PoC repository https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The DrayTek Vigor2960 is a multi-WAN router whose administrative UI is implemented as a CGI application served from /cgi-bin/mainfunction.cgi. In the affected firmware (1.5.1.6 Revision 8218), the internal function sub_182B0 processes the usefile, usescript, and option request parameters and incorporates them into a system-level command without proper neutralization of shell metacharacters, the classic CWE-78 OS command injection pattern. Because the injection point is reachable over HTTP(S) on the management interface, an attacker who has obtained a valid low-privilege session (CVSS PR:L) can pivot from the web UI to arbitrary command execution with the privileges of the CGI process. The public PoC case is labeled 'authenticated-jsonstatus-usefile-file-clobber', indicating the jsonstatus endpoint and usefile handling are part of the exploit path. CPE data lists the product family with a wildcard version, but the description and vendor statement scope the issue to 1.5.1.6; 1.5.1.7 is cited as correcting multiple security issues.
Know when Vigor2960 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
Network-reachable CGI command injection requiring low-privilege authentication (PR:L) per the authenticated PoC; code execution on the device yields full C/I/A, scope unchanged as the CGI already runs on the target host.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes os command injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Technical POC Analysis
CWE-78 (OS command injection) in DrayTek Vigor2960 firmware 1.5.1.6 revision 8218, in the CGI binary /cgi-bin/mainfunction.cgi.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
The DrayTek Vigor2960 running firmware 1.5.1.6 Revision 8218 has a high-severity command-injection flaw in its web management interface, and publicly available exploit code exists. Because the platform is End-of-Service, any remaining internet-facing or broadly reachable management interfaces represent a material operational risk for network operations and teams relying on these devices for branch or remote connectivity. An attacker who reaches the interface could execute arbitrary commands on the device and use it as a foothold into the network.
No vendor-released patch identified at time of analysis. Restrict the administrative UI to a trusted management VLAN or VPN, disable WAN-side management, enforce least-privilege access and MFA where supported, monitor/IDS for /cgi-bin/mainfunction.cgi exploit attempts, segment the device, and accelerate replacement of End-of-Service Vigor2960 units.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows a low-privileged user with valid crede
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 lets a low-privileged user of the web managem
Path traversal in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated low-privilege user to manipulate the s
Authenticated command injection in the IPsec certificate-handling path of DrayTek Vigor2960 routers running firmware 1.5
Authenticated path traversal in the End-of-Sale DrayTek Vigor2960 1.5.1.6 web management interface lets a low-privilege
Authenticated remote attackers can exploit an unrestricted file-upload flaw in DrayTek Vigor2960 firmware 1.5.1.6 Revisi
Authenticated path traversal in DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) lets a user with a valid web-manageme
Exploit-DB