Skip to content
Critical RCE Flaw in DrayTek Vigor2960 Exposes Legacy Routers

Critical RCE Flaw in DrayTek Vigor2960 Exposes Legacy Routers

First seen 20 Oct 2026, 20:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 22:21 UTC
  • •CVE-2026-113390 is a critical RCE vulnerability with a CVSS score of 9.4.
  • •The flaw affects DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218.
  • •DrayTek has declared the Vigor2960 end-of-life, limiting support for this model.

A critical command injection vulnerability has been identified in DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218, classified as CVE-2026-113390 with a CVSS score of 9.4. The flaw allows remote attackers to execute arbitrary operating system commands via the CGI Interface component. DrayTek has declared the Vigor2960 end-of-life, providing limited support only for major unauthenticated issues. As the exploit code has been published, the risk of automated attacks is heightened for exposed devices. Organizations using these routers are advised to assess their exposure and consider upgrading to supported alternatives. The vendor has indicated that version 1.5.1.7 addresses many security issues but will not receive further patches. Managed service providers should prioritize identifying vulnerable devices in client networks and isolate them from the internet.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
CVE-2026-113390 published
A critical command injection flaw in DrayTek Vigor2960 routers was disclosed, allowing remote exploitation.
Patchobserver
2026-10-20
Exploit code published
Research revealed that the vulnerability can be exploited remotely, increasing the risk for exposed devices.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-113390 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 4

Common questions

Which versions of DrayTek routers are affected?
The vulnerability affects DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218.
Is there a patch available for this vulnerability?
A newer firmware version 1.5.1.7 exists that addresses many security issues, but DrayTek has declared the Vigor2960 end-of-life.
What should organizations do to protect themselves?
Organizations should identify and isolate vulnerable devices and consider upgrading to supported alternatives.