CVE-2026-113393 DrayTek CVE debrief

Who should care

Defenders responsible for DrayTek Vigor2960 devices should assess exposure and prioritize upgrading to version 1.5.1.7. This includes operators, platform administrators, vulnerability management teams, and security teams. They should verify exposure, assess potential impact, and plan for vendor-supported updates or mitigations. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Monitoring and detection

Why it matters

Defenders should care about CVE-2026-113393 because it allows for unrestricted upload attacks on DrayTek Vigor2960 devices, potentially leading to file manipulation and compromise.

• Verify exposure of DrayTek Vigor2960 devices to unrestricted upload attacks
• Assess the impact of potential file manipulation on the device and connected systems
• Prioritize upgrading to version 1.5.1.7 to address the vulnerability

Technical summary

A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. Upgrading to version 1.5.1.7 is capable of addressing this issue. The vendor explains that version 1.5.1.7 has corrected many security issues. The affected version 1.5.1.6 Revision 8218 is vulnerable to unrestricted upload attacks.

Defensive priority

Defenders should prioritize upgrading to version 1.5.1.7, as the affected version 1.5.1.6 Revision 8218 is vulnerable to unrestricted upload attacks.

Recommended defensive actions

• Upgrade to version 1.5.1.7
• Restrict access to the /cgi-bin/mainfunction.cgi file
• Monitor for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. The exploit has been publicly disclosed and may be utilized. Defenders should verify exposure and assess potential impact. Evidence is limited to public sources and CVE metadata. Verify affected scope and vendor guidance for accurate risk assessment. The CVE Program record and NVD detail page provide additional context.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.