EUVD-2026-105013
GHSA-r9v6-xv95-6v78
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid device credentials
-
DeliveryReach web mgmt /cgi-bin/mainfunction.cgi
-
ExploitInject OS commands via newtable in rename_table
-
ExecutionExecute commands on router OS
-
ImpactFull device compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Requires an authenticated session to the Vigor2960 web management interface (CVSS PR:L); the attacker then manipulates the newtable argument passed to the rename_table function in /cgi-bin/mainfunction.cgi (the Rename Table Handler) to inject OS commands. Exploitation is limited by: the need for valid credentials/management-interface access, applicability only to firmware 1.5.1.6 Revision 8218 and earlier (fixed in 1.5.1.7), and the product being End-of-Support so only exposed legacy units are affected. No user interaction is required once authenticated. |
| Impact | Signals here are notably mixed. The vulnerability is OS command injection (CWE-74) in the rename_table handler, which in reality typically yields full device compromise, yet the input CVSS 4.0 vector rates every impact dimension as Low (VC:L/VI:L/VA:L) for an overall score of only 2.1 - this is internally inconsistent with command execution on an embedded router and likely understates true impact; verify impact scoring with the vendor/CNA. The vector is network-reachable (AV:N) with low complexity (AC:L) but requires privileges (PR:L), i.e. an authenticated attacker - corroborated by the referenced GitHub case titled 'authenticated-rename-table-command-injection'. A public exploit exists (POC=YES) which raises practical risk, but there is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active, widespread exploitation at this time. The product is explicitly End-of-Sale/End-of-Support, which caps the realistic blast radius to legacy deployments. Net: this is a genuine authenticated-RCE-class flaw with public exploit code, more serious than its 2.1 score implies, but the authentication requirement and EoS status make it a targeted/legacy concern rather than a mass-exploitation emergency. |
| Exploit ScenarioDerived | An attacker with valid (even low-privilege) credentials to the Vigor2960 web management interface sends a crafted request to /cgi-bin/mainfunction.cgi invoking the rename_table function with a malicious newtable argument, injecting OS commands that execute on the router. Because a public exploit is already available and the attack is network-reachable with low complexity, an authenticated insider or an attacker who has phished/brute-forced credentials could trivially reproduce it. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Authenticated command injection in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 allows a user with access to the web management interface to execute arbitrary OS commands by manipulating the newtable argument in the rename_table function of /cgi-bin/mainfunction.cgi. Publicly available exploit code exists in the GitHub DrayTek_Vigor2960_Security_Analysis repository (case DRV2960-0013), but no CISA KEV confirmation was provided. The vendor fixed the issue in firmware 1.5.1.7, though DrayTek states the Vigor2960 is end-of-support with limited support, so only legacy exposed units remain affected.
RemediationAI
Upgrade to DrayTek Vigor2960 firmware 1.5.1.7 (https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip), which the vendor states corrects many security issues including this one. Because the 2960 is end-of-support and patching may not be feasible for all deployments, apply compensating controls: disable WAN-side/remote web management and restrict the management interface to a trusted internal VLAN or management network via ACL/firewall rules (trade-off: loses remote administration convenience); require VPN access for administration and rotate credentials for accounts that can reach mainfunction.cgi (trade-off: operational overhead, but reduces exposure from compromised low-privilege accounts); and monitor HTTP requests for suspicious newtable values plus unusual child processes spawned by the CGI (trade-off: detection rather than prevention). Technical details are at https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0013-authenticated-rename-table-command-injection and https://vuldb.com/vuln/422672.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Vigor2960 is a DrayTek router whose administrative web interface is implemented through CGI, with /cgi-bin/mainfunction.cgi handling actions such as renaming tables. In the rename_table handler, the user-supplied newtable value is passed into a command/shell context without adequate neutralization, placing it in the CWE-74 injection class and specifically enabling OS command injection as tagged. Shell metacharacters in newtable can break out of the intended operation and run commands with the privileges of the CGI process. Exploitation requires a valid management session (CVSS PR:L) and no user interaction; the independent assessment rates confidentiality, integrity, and availability impact as high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting arbitrary command execution, even though the CNA's CVSS 4.0 score is much lower. The attack surface is the router's HTTP management service wherever it is reachable.
Know when Draytek gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P
Authenticated web-interface access gives PR:L with low complexity; OS command injection yields full code execution on the router, so C/I/A:H rather than the input's understated Low impacts.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
DescriptionCVE.org
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 1.5.1.7 is sufficient to resolve this issue. It is suggested to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary comman
An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbit
Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmwa
An issue was discovered on certain DrayTek Vigor routers before July 2022 such as the Vigor3910 before 4.3.1.1. Rated cr
An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileSe
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote
Stack-based buffer overflow vulnerability in Vigor3900, Vigor2960, and Vigor300B with firmware before 1.5.1.1. Rated cri
On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities
A stack-based buffer overflow on DrayTek Vigor2960, Vigor3900, and Vigor300B devices before 1.5.1.1 allows remote attack
A stack-based buffer overflow in cvmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote
A stack-based buffer overflow in apmd on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote
/cgi-bin/activate.cgi on Draytek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1 allows remote attackers to ach
Exploit-DB