Answer in brief
CVE-2026-113389 records a Critical severity (CVSS 9.4) vulnerability in DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection. The current sources do not mark it as known exploited. The current feed maps DrayTek/Vigor2960 (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps DrayTek/Vigor2960 (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| DrayTek/Vigor2960generic | 1.5.1.6 Revision 8218 | Not reported |
Published upstream
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 20, 2026
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launched remotely. The exploit is now public and may be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Quoted source text, attributed separately from HOL analysis.