Is CVE-2026-113393 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113393 being exploited in the wild.

How severe is CVE-2026-113393?

Medium severity, with a CVSS score of 6.3, published 20 October 2026.

Which products and versions are affected?

DrayTek Vigor2960 1.5.1.6 (revision 8218).

How is CVE-2026-113393 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-113393?

Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113393: DrayTek Vigor2960 arbitrary file write in commonupload

CVE-2026-113393 · Severity: medium · CVSS 6.3 · Published 2026-10-20

The DrayTek Vigor2960 router contains a file upload feature in its web administration interface that does not properly validate upload paths. An authenticated administrator can exploit this to write arbitrary files to any location on the device, potentially overwriting critical system files and gaining persistent control. Since the upload handler runs as root, an attacker could also execute arbitrary commands on the device.

Technologies: DrayTek Vigor2960. Vendors: DrayTek.

Quick answers

Is CVE-2026-113393 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113393 being exploited in the wild.
How severe is CVE-2026-113393?: Medium severity, with a CVSS score of 6.3, published 20 October 2026.
Which products and versions are affected?: DrayTek Vigor2960 1.5.1.6 (revision 8218).
Is there a fix for CVE-2026-113393?: Yes: fixed in Vigor2960 1.5.1.7. Until then: Restrict administrator access to the web interface to trusted networks only, and upgrade to firmware version 1.5.1.7. The vendor notes that Vigor2960 is end-of-support with limited support available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113393 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-113393?: Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vigor2960 1.5.1.7

Restrict administrator access to the web interface to trusted networks only, and upgrade to firmware version 1.5.1.7. The vendor notes that Vigor2960 is end-of-support with limited support available.

Technical details

The /cgi-bin/mainfunction.cgi endpoint's commonupload function fails to sanitize the upload_path and upload_name parameters before passing them to a system mv command. An authenticated attacker can craft these parameters to write uploaded content to arbitrary filesystem paths (e.g., /var/status_system_interface) or execute arbitrary shell commands via command injection in the unquoted upload_path parameter. The vulnerability requires administrator authentication and affects only end-of-support Vigor2960 1.5.1.6 (revision 8218), which was patched in version 1.5.1.7.

Affected products

DrayTek Vigor2960 1.5.1.6 (revision 8218)

Timeline

2026-10-20: disclosed
2026-10-20: patched: Firmware version 1.5.1.7 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.