Key points
- DrayTek released version 1.5.1.7 to fix a critical command injection flaw in the Vigor2960 router.
- The vulnerability allows remote attackers to execute commands on the device via an upload endpoint.
- The affected router model is officially end-of-support, with limited future security reviews.
Attackers who exploit this flaw can execute commands remotely on the DrayTek Vigor2960 router. The weakness exists in a file upload function that fails to sanitise user input. This allows malicious code to run on the device’s operating system. The issue is rated as critical by security databases. The exploit has been disclosed to the public and may be used.
In plain English
The router accepts file uploads through a specific web interface function. When a user sends data to this endpoint, the system processes it incorrectly. Instead of treating the data as harmless text, the router executes it as system commands. This means an attacker can send a specially crafted request from anywhere on the internet. The router then carries out the instructions embedded in that request.
The background
The vulnerability affects DrayTek Vigor2960 routers running firmware version 1.5.1.6 Revision 8218. According to the National Vulnerability Database, the flaw is tracked as CVE-2026-113391. It carries a CVSS score of 9.4, which is classified as critical. DrayTek has released version 1.5.1.7, which corrects this and other security issues. The vendor notes that the Vigor2960 is end-of-support.
What changes now
Users running the affected version must upgrade to 1.5.1.7 to mitigate the risk. DrayTek states that the older version is no longer fully supported. The company will only review major issues, such as unauthenticated vulnerabilities, for this model. Public exploits for this flaw are already available online. This means the exploit has been disclosed and may be used by attackers.
The attacker's path
Remote code execution flaws like this allow adversaries to execute commands on a target system. Attackers typically scan for known vulnerable software versions on the internet. Once a target is identified, they send a crafted request to the vulnerable endpoint. This grants them immediate access to the underlying system. Security teams usually monitor for unusual outbound traffic or new processes. Check whether your devices are exposed to public networks and restrict access to management interfaces where possible.
Background: File upload vulnerabilities
Monitor for unexpected MIME types, rapid sequential uploads, and execution attempts from storage directories. Combine server-side validation with strict content-type checking. Review file naming patterns for double extensions. Use automated scanning to find misconfigurations that allow script execution in upload folders.
Read the full guide: Detect File Upload Vulnerabilities: Log Signals and Blind Spots
What to do and how to stay safe: DrayTek
- Verify if your DrayTek Vigor2960 routers are running firmware version 1.5.1.6 Revision 8218.
- Upgrade affected devices to version 1.5.1.7 as soon as possible to apply the security fix.
- Restrict access to the router’s web management interface from the public internet.
- Monitor network logs for unexpected connections or commands originating from the router.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which DrayTek routers are affected by this vulnerability?
Only the DrayTek Vigor2960 running firmware version 1.5.1.6 Revision 8218 is affected.
Is there a patch available for this issue?
Yes, DrayTek has released firmware version 1.5.1.7 which corrects the security issues.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-113391 as critical with a CVSS score of 9.4.
