Is CVE-2026-113394 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113394 being exploited in the wild.

How severe is CVE-2026-113394?

High severity, with a CVSS score of 7.4, published 20 October 2026.

Which products and versions are affected?

DrayTek Vigor2960 1.5.1.6 Revision 8218.

How is CVE-2026-113394 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-113394?

Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113394: DrayTek Vigor2960 path traversal and command injection in setSWMProfile

CVE-2026-113394 · Severity: high · CVSS 7.4 · Published 2026-10-20

DrayTek Vigor2960 is a network router used to manage enterprise connectivity. An authenticated administrator can exploit a path traversal vulnerability in the setSWMProfile function to write arbitrary files to the device filesystem or execute arbitrary commands as root. This allows an attacker with valid admin credentials to compromise router functionality and gain full system control.

Technologies: DrayTek Vigor2960. Vendors: DrayTek.

Quick answers

Is CVE-2026-113394 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113394 being exploited in the wild.
How severe is CVE-2026-113394?: High severity, with a CVSS score of 7.4, published 20 October 2026.
Which products and versions are affected?: DrayTek Vigor2960 1.5.1.6 Revision 8218.
Is there a fix for CVE-2026-113394?: Yes: fixed in Vigor2960 1.5.1.7. Until then: Restrict administrative access to the Vigor2960 management interface to trusted networks only, and disable remote administration if not required. However, the vendor states this product is end-of-support and upgrade to version 1.5.1.7 or a current model is strongly recommended. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113394 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-113394?: Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vigor2960 1.5.1.7

Restrict administrative access to the Vigor2960 management interface to trusted networks only, and disable remote administration if not required. However, the vendor states this product is end-of-support and upgrade to version 1.5.1.7 or a current model is strongly recommended.

Technical details

The setSWMProfile function in /cgi-bin/mainfunction.cgi concatenates an attacker-controlled filename parameter directly to the fixed path /data/swm/ without filtering path traversal sequences (../) or normalizing the result, allowing arbitrary file writes. Additionally, the same filename is passed unsanitized into shell commands executed via system(), enabling command injection through single-quote escape. The vulnerability requires an authenticated administrator session and affects Vigor2960 1.5.1.6 Revision 8218, which is end-of-support.

Affected products

DrayTek Vigor2960 1.5.1.6 Revision 8218

Timeline

2026-10-20: disclosed
other: Exploit code publicly available

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.