{"metadata": {"vulnerability": "CVE-2026-113391", "count": 19, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 11}}, "data": [{"timestamp": "2026-10-20T00:00:00Z", "date_only": false, "value": "2026-10-20T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-113391", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-20T02:00:00Z", "date_only": false, "value": "2026-10-20T02:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-113391", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-20T05:50:15.239Z", "date_only": false, "value": "2026-10-20T05:50:15.239Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-20T07:55:52Z", "date_only": false, "value": "2026-10-20T07:55:52.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-113391", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-113391", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T12:59:08.036Z", "date_only": false, "value": "2026-10-20T12:59:08.036481Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117473355198321474", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "6b63f596-b7b1-4561-aabf-d18e1046519f", "content": "CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor explains: \"2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)\". This vulnerability only affects products that are no longer supported by the maintainer.\nhttps://www.cve.org/CVERecord?id=CVE-2026-113391https://vuldb.com/vuln/422667https://vuldb.com/vuln/422667/ctihttps://vuldb.com/cve/CVE-2026-113391https://vuldb.com/submit/992244https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0008-authenticated-upload-filename-command-injectionhttps://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip#draytek #DrayTek #Vigor2960#CVE_2026_113391#bot", "url": "https://infosec.exchange/users/cve/statuses/117473355198321474"}, {"timestamp": "2026-10-20T13:16:40Z", "date_only": false, "value": "2026-10-20T13:16:40Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-F3VF-PM24-G43P", "record": "GHSA-F3VF-PM24-G43P", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-20T13:16:40.640Z", "date_only": false, "value": "2026-10-20T13:16:40.640", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-113391", "record": "FKIE_CVE-2026-113391", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-20T13:30:27.572Z", "date_only": false, "value": "2026-10-20T13:30:27.572928Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117473478307145550", "record": "cve-2026-113391", "field": "creation_timestamp", "uuid": "f03af84f-a6f0-4237-9349-acf8038649f3", "content": "DrayTek Vigor2960 v1.5.1.6 hit by CRITICAL (CVSS 9.4) command injection (CVE-2026-113391) in /cgi-bin/mainfunction.cgi. Public exploit out. Upgrade to 1.5.1.7 ASAP. End-of-support. https://radar.offseq.com/threat/cve-2026-113391-command-injection-in-draytek-vigor2960-9b89f32caa42b002 #OffSeq #Vulnerability #Infosec #DrayTek", "url": "https://infosec.exchange/users/offseq/statuses/117473478307145550"}, {"timestamp": "2026-10-20T15:00:19Z", "date_only": false, "value": "2026-10-20T15:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6DIjjJWEsmjh7O7EfmnVKpIuVcFktN42lLDPq8UStEex2JI", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "565c6310-63a1-4daa-a3fa-2943a94fb66e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-20T15:00:19Z", "date_only": false, "value": "2026-10-20T15:00:19.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/6DIjjJWEsmjh7O7EfmnVKpIuVcFktN42lLDPq8UStEex2JI", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "65a0f261-e618-4e3a-805e-744c19b336f5"}, {"timestamp": "2026-10-20T15:31:23Z", "date_only": false, "value": "2026-10-20T15:31:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F3VF-PM24-G43P", "record": "GHSA-F3VF-PM24-G43P", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-20T15:31:23Z", "date_only": false, "value": "2026-10-20T15:31:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F3VF-PM24-G43P", "record": "GHSA-F3VF-PM24-G43P", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-20T15:52:06.030Z", "date_only": false, "value": "2026-10-20T15:52:06.030999Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-113391", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-20T15:52:06.030Z", "date_only": false, "value": "2026-10-20T15:52:06.030999Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-113391", "record": "FKIE_CVE-2026-113391", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-10-20T15:52:14.652Z", "date_only": false, "value": "2026-10-20T15:52:14.652Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-20T15:52:14.652Z", "date_only": false, "value": "2026-10-20T15:52:14.652Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-113391", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-20T19:27:34.430Z", "date_only": false, "value": "2026-10-20T19:27:34.430", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-113391", "record": "FKIE_CVE-2026-113391", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-04T23:47:32.776Z", "anchors": {"origin": {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-20T15:00:19Z", "date_only": false, "value": "2026-10-20T15:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6DIjjJWEsmjh7O7EfmnVKpIuVcFktN42lLDPq8UStEex2JI", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "565c6310-63a1-4daa-a3fa-2943a94fb66e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 8099.018, "hours": 2.2497272222222224, "days": 0.09373863425925925, "min_seconds": 8099.018, "max_seconds": 8099.018, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-20T15:00:19Z", "date_only": false, "value": "2026-10-20T15:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6DIjjJWEsmjh7O7EfmnVKpIuVcFktN42lLDPq8UStEex2JI", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "565c6310-63a1-4daa-a3fa-2943a94fb66e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1335732.794558, "hours": 371.03688737722223, "days": 15.45987030738426, "min_seconds": 1335732.794558, "max_seconds": 1335732.794558, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-20T12:45:19.982Z", "date_only": false, "value": "2026-10-20T12:45:19.982Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-113391", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-04T23:47:32.776Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 1327633.776558, "hours": 368.787160155, "days": 15.366131673124999, "min_seconds": 1327633.776558, "max_seconds": 1327633.776558, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-20T15:00:19Z", "date_only": false, "value": "2026-10-20T15:00:19.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6DIjjJWEsmjh7O7EfmnVKpIuVcFktN42lLDPq8UStEex2JI", "record": "CVE-2026-113391", "field": "creation_timestamp", "uuid": "565c6310-63a1-4daa-a3fa-2943a94fb66e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-04T23:47:32.776Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}