PatchSiren cyber security CVE debrief

CVE-2026-113396 DrayTek CVE debrief

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218, specifically in the rename_table function of the /cgi-bin/mainfunction.cgi file. This vulnerability allows for command injection via manipulation of the newtable argument and can be initiated remotely. The exploit has been made public and could be used for attacks. Upgrading to version 1.5.1.7 resolves this issue. This vulnerability affects products that are no longer supported by the maintainer.

Vendor: DrayTek
Product: Vigor2960
CVSS: MEDIUM 5.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-20
Original CVE updated: 2026-10-20
Advisory published: 2026-10-20
Advisory updated: 2026-10-20

Who should care

Defenders responsible for DrayTek Vigor2960 devices, especially those running version 1.5.1.6 Revision 8218, should assess exposure and prioritize upgrading to version 1.5.1.7. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of their systems.

Why it matters

Defenders should care about CVE-2026-113396 as it allows for remote command injection in DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218. The exploit has been made public, and the affected products are no longer supported, making upgrade to version 1.5.1.7 a priority.

Remote command injection possible
Exploit has been made public and could be used for attacks
Affected products are no longer supported by the maintainer

Technical summary

The vulnerability is located in the rename_table function of the /cgi-bin/mainfunction.cgi file in DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218. It allows for remote command injection through manipulation of the newtable argument. The exploit has been made public, and the affected products are no longer supported by the maintainer. Upgrading to version 1.5.1.7 resolves this issue. Defenders should prioritize upgrading to version 1.5.1.7 as the affected products are no longer supported, and the vulnerability allows for remote command injection.

Defensive priority

Defenders should prioritize upgrading to version 1.5.1.7 as the affected products are no longer supported.

Recommended defensive actions

Upgrade to version 1.5.1.7
Assess exposure of DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218
Verify the integrity of affected devices
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the available patch. The vulnerability allows for remote command injection via manipulation of the newtable argument in the rename_table function of the /cgi-bin/mainfunction.cgi file in DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218. The exploit has been made public, and the affected products are no longer supported by the maintainer. Defenders should verify the integrity of affected devices and assess exposure.

Sources and references

Verified primary and authoritative sources

CVE-2026-113396 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-113396

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-113396 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113396

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
Unverified legacy reference

URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113396.json

cve_program_cvelist_v5
Source reference
Unverified legacy reference

URL: https://vuldb.com/vuln/422672

Supplemental source - vdb-entry, technical-description
Source reference
Unverified legacy reference

URL: https://vuldb.com/vuln/422672/cti

Supplemental source - signature, permissions-required
Source reference
Unverified legacy reference

URL: https://vuldb.com/cve/CVE-2026-113396

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://vuldb.com/submit/992249

Supplemental source - third-party-advisory
Source reference
Unverified legacy reference

URL: https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0013-authenticated-rename-table-command-injection

Supplemental source - exploit
Source reference
Unverified legacy reference

URL: https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip

Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.