CVE-2026-113397 DrayTek CVE debrief

Who should care

Defenders responsible for DrayTek Vigor2960 devices, especially those exposed to the internet or untrusted networks, should assess their exposure and prioritize patching or mitigating this vulnerability.

Why it matters

CVE-2026-113397 is a command injection vulnerability in DrayTek Vigor2960 devices. Defenders should prioritize patching, restrict access, and monitor for suspicious activity. The vulnerability allows remote attackers to inject commands, potentially leading to unauthorized access, lateral movement, and data breaches.

• Remote command injection may lead to unauthorized access
• Potential for lateral movement within the network
• Elevation of privileges may occur if exploited
• Data breaches or modifications are possible

Technical summary

The ruequest_certificate function in the /cgi-bin/mainfunction.cgi file of DrayTek Vigor2960 version 1.5.1.6 Revision 8218 is vulnerable to command injection. The vulnerability is caused by improper sanitization of user input in the option argument. This allows remote attackers to inject arbitrary commands. Affected product deployments should be reviewed for exposure, and defenders should prioritize patching or mitigating this vulnerability, especially for systems exposed to the internet or untrusted networks, as it allows for remote command injection. The exploit has been publicly disclosed and may be used.

Defensive priority

Defenders should prioritize patching or mitigating this vulnerability, especially for systems exposed to the internet or untrusted networks, as it allows for remote command injection.

Recommended defensive actions

• Patch or upgrade to version 1.5.1.7
• Restrict access to the IPsec Handler
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details about the vulnerability, its impact, and the affected product. However, the corpus does not establish versions beyond 1.5.1.6 and 1.5.1.7, exploitation, or specific remediation steps beyond upgrading to version 1.5.1.7.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.