# DrayTek Vigor2960 vulnerabilities Source: https://junglewise.ai/threats/technologies/vigor2960 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/vigor2960.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in DrayTek Vigor2960: 0 in the last 7 days and 9 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113397, was published on 20 October 2026. 9 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. ## Counts - Last 7 days: 0 - Last 30 days: 9 - Last 90 days: 9 - All time: 9 (3 critical, 0 exploited in the wild) ## About DrayTek Vigor2960 Multi-WAN router and firewall appliance with VPN and advanced networking capabilities. ## Latest DrayTek Vigor2960 vulnerabilities - [CVE-2026-113397: DrayTek Vigor2960 command injection in IPsec handler](https://junglewise.ai/threats/cve-2026-113397-a-security-vulnerability-has-been-detected-in-draytek-vigor2960) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113396: DrayTek Vigor2960 command injection in rename table handler](https://junglewise.ai/threats/cve-2026-113396-a-weakness-has-been-identified-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113395: DrayTek Vigor2960 path traversal in swmconfigupload](https://junglewise.ai/threats/cve-2026-113395-a-security-flaw-has-been-discovered-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113394: DrayTek Vigor2960 path traversal and command injection in setSWMProfile](https://junglewise.ai/threats/cve-2026-113394-a-vulnerability-was-identified-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113393: DrayTek Vigor2960 arbitrary file write in commonupload](https://junglewise.ai/threats/cve-2026-113393-a-vulnerability-was-determined-in-draytek-vigor2960-1-5-1-6) (medium, CVSS 6.3, published 20 Oct 2026) - [CVE-2026-113392: DrayTek Vigor2960 path traversal in apmupload](https://junglewise.ai/threats/cve-2026-113392-a-vulnerability-was-found-in-draytek-vigor2960-1-5-1-6-revision) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113391: DrayTek Vigor2960 command injection in upload endpoints](https://junglewise.ai/threats/cve-2026-113391-a-vulnerability-has-been-found-in-draytek-vigor2960-1-5-1-6) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113390: DrayTek Vigor2960 OS command injection in CGI interface](https://junglewise.ai/threats/cve-2026-113390-a-flaw-has-been-found-in-draytek-vigor2960-1-5-1-6-revision-8218) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113389: DrayTek Vigor2960 command injection in CGI](https://junglewise.ai/threats/cve-2026-113389-a-vulnerability-was-detected-in-draytek-vigor2960-1-5-1-6) (critical, CVSS 9.9, published 20 Oct 2026) ## Most severe DrayTek Vigor2960 vulnerabilities - [CVE-2026-113391: DrayTek Vigor2960 command injection in upload endpoints](https://junglewise.ai/threats/cve-2026-113391-a-vulnerability-has-been-found-in-draytek-vigor2960-1-5-1-6) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113390: DrayTek Vigor2960 OS command injection in CGI interface](https://junglewise.ai/threats/cve-2026-113390-a-flaw-has-been-found-in-draytek-vigor2960-1-5-1-6-revision-8218) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113389: DrayTek Vigor2960 command injection in CGI](https://junglewise.ai/threats/cve-2026-113389-a-vulnerability-was-detected-in-draytek-vigor2960-1-5-1-6) (critical, CVSS 9.9, published 20 Oct 2026) - [CVE-2026-113397: DrayTek Vigor2960 command injection in IPsec handler](https://junglewise.ai/threats/cve-2026-113397-a-security-vulnerability-has-been-detected-in-draytek-vigor2960) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113396: DrayTek Vigor2960 command injection in rename table handler](https://junglewise.ai/threats/cve-2026-113396-a-weakness-has-been-identified-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113395: DrayTek Vigor2960 path traversal in swmconfigupload](https://junglewise.ai/threats/cve-2026-113395-a-security-flaw-has-been-discovered-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113394: DrayTek Vigor2960 path traversal and command injection in setSWMProfile](https://junglewise.ai/threats/cve-2026-113394-a-vulnerability-was-identified-in-draytek-vigor2960-1-5-1-6) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113392: DrayTek Vigor2960 path traversal in apmupload](https://junglewise.ai/threats/cve-2026-113392-a-vulnerability-was-found-in-draytek-vigor2960-1-5-1-6-revision) (high, CVSS 7.4, published 20 Oct 2026) - [CVE-2026-113393: DrayTek Vigor2960 arbitrary file write in commonupload](https://junglewise.ai/threats/cve-2026-113393-a-vulnerability-was-determined-in-draytek-vigor2960-1-5-1-6) (medium, CVSS 6.3, published 20 Oct 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up from none in the four before. 3 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 9 | 3 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other DrayTek technologies - [DrayTek VigorSwitch FX2120](https://junglewise.ai/threats/technologies/vigorswitch-fx2120): 29 vulnerabilities - [DrayTek VigorSwitch G1280](https://junglewise.ai/threats/technologies/vigorswitch-g1280): 29 vulnerabilities - [DrayTek VigorSwitch G1282](https://junglewise.ai/threats/technologies/vigorswitch-g1282): 29 vulnerabilities - [DrayTek VigorSwitch G2100](https://junglewise.ai/threats/technologies/vigorswitch-g2100): 29 vulnerabilities - [DrayTek VigorSwitch G2121](https://junglewise.ai/threats/technologies/vigorswitch-g2121): 29 vulnerabilities - [DrayTek VigorSwitch G2280x](https://junglewise.ai/threats/technologies/vigorswitch-g2280x): 29 vulnerabilities - [DrayTek VigorSwitch G2282x](https://junglewise.ai/threats/technologies/vigorswitch-g2282x): 29 vulnerabilities - [DrayTek VigorSwitch G2540x](https://junglewise.ai/threats/technologies/vigorswitch-g2540x): 29 vulnerabilities - [DrayTek VigorSwitch G2540xs](https://junglewise.ai/threats/technologies/vigorswitch-g2540xs): 29 vulnerabilities - [DrayTek VigorSwitch G2542x](https://junglewise.ai/threats/technologies/vigorswitch-g2542x): 29 vulnerabilities - [DrayTek VigorSwitch P1280](https://junglewise.ai/threats/technologies/vigorswitch-p1280): 29 vulnerabilities - [DrayTek VigorSwitch P1281x](https://junglewise.ai/threats/technologies/vigorswitch-p1281x): 29 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "DrayTek Vigor2960 vulnerabilities", https://junglewise.ai/threats/technologies/vigor2960, 9 November 2026.