# CVE-2026-113397: DrayTek Vigor2960 command injection in IPsec handler

Source: https://junglewise.ai/threats/cve-2026-113397-a-security-vulnerability-has-been-detected-in-draytek-vigor2960  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113397 · Severity: high · CVSS 7.4 · Published 2026-10-20

DrayTek Vigor2960 is a network router used to manage IPsec VPN connections. A flaw in the certificate request function allows an authenticated administrator to inject arbitrary shell commands and gain full control of the device, potentially exposing or disrupting all network traffic passing through it.

Technologies: [DrayTek Vigor2960](https://junglewise.ai/threats/technologies/vigor2960). Vendors: [DrayTek](https://junglewise.ai/threats/vendors/draytek).

## Quick answers

**Is CVE-2026-113397 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113397 being exploited in the wild.

**How severe is CVE-2026-113397?** High severity, with a CVSS score of 7.4, published 20 October 2026.

**Which products and versions are affected?** DrayTek Vigor2960 1.5.1.6 Revision 8218 and earlier.

**Is there a fix for CVE-2026-113397?** Yes: fixed in Vigor2960 1.5.1.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113397 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-113397?** Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Vigor2960 1.5.1.7

## Technical details

The ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler) fails to properly escape the user-controlled "option" parameter before passing it to a shell command via snprintf and system(). An authenticated attacker can break out of the single-quoted context with a payload like foo';<command>;# to execute arbitrary shell commands with mainfunction.cgi privileges. A public proof-of-concept demonstrates achieving an interactive reverse shell on the device.

## Affected products

- DrayTek Vigor2960 1.5.1.6 Revision 8218 and earlier

## Timeline

- 2026-10-20: disclosed
- 2026-10-20: advisory

## References

- [https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip](https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip)
- [https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0014-authenticated-request-certificate-command-injection](https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0014-authenticated-request-certificate-command-injection)

## Related threats

- [DrayTek Vigor2960 command injection in rename table handler](https://junglewise.ai/threats/cve-2026-113396-a-weakness-has-been-identified-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 path traversal in swmconfigupload](https://junglewise.ai/threats/cve-2026-113395-a-security-flaw-has-been-discovered-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 path traversal and command injection in setSWMProfile](https://junglewise.ai/threats/cve-2026-113394-a-vulnerability-was-identified-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 arbitrary file write in commonupload](https://junglewise.ai/threats/cve-2026-113393-a-vulnerability-was-determined-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 path traversal in apmupload](https://junglewise.ai/threats/cve-2026-113392-a-vulnerability-was-found-in-draytek-vigor2960-1-5-1-6-revision)