Quick answers
- Is CVE-2026-113391 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-113391 being exploited in the wild.
- How severe is CVE-2026-113391?
- Critical severity, with a CVSS score of 9.9, published 20 October 2026.
- Which products and versions are affected?
- DrayTek Vigor2960 1.5.1.6 Revision 8218.
- Is there a fix for CVE-2026-113391?
- Yes: fixed in Vigor2960 1.5.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-113391 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-113391?
- Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: Vigor2960 1.5.1.7
Technical details
The vulnerability is a command injection flaw in multiple authenticated file upload handlers (/uploadlangs, /certificaterequestupload, /userkeyupload, /usercertificateupload, /trustcaupload) in /cgi-bin/mainfunction.cgi. The handlers insufficiently sanitize the uploaded filename before passing it to shell commands (unquoted mv or single-quoted /sbin/import_* commands), allowing an attacker with administrator credentials to break out of quoting and inject arbitrary shell commands. Authentication is required as a prerequisite.
Affected products
- DrayTek Vigor2960 1.5.1.6 Revision 8218
Timeline
- 2026-10-20: disclosed