CVE-2026-3040
Published: 23 February 2026
Summary
CVE-2026-3040 is a medium-severity Command Injection (CWE-77) vulnerability in Draytek Vigor300B Firmware. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OS command injection in exposed web management interface directly enables exploitation of public-facing application for initial device access (T1190) and arbitrary command execution on network device (T1059.008).
NVD Description
A vulnerability was identified in DrayTek Vigor 300B up to 1.5.1.6. This affects the function cgiGetFile of the file /cgi-bin/mainfunction.cgi/uploadlangs of the component Web Management Interface. The manipulation of the argument File leads to os command injection. The attack may…
more
be initiated remotely. The exploit is publicly available and might be used. The vendor confirms that "300B is EoL, and this is an authenticated vulnerability. We don't plan to fix it." This vulnerability only affects products that are no longer supported by the maintainer.
Deeper analysisAI
CVE-2026-3040 is an OS command injection vulnerability in DrayTek Vigor 300B routers running firmware versions up to 1.5.1.6. It affects the cgiGetFile function within the /cgi-bin/mainfunction.cgi/uploadlangs endpoint of the Web Management Interface, where manipulation of the File argument enables command injection. The issue is classified under CWE-77 (Command Injection) and CWE-78 (OS Command Injection), with a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).
An authenticated remote attacker with high privileges, such as administrative access to the Web Management Interface, can exploit this vulnerability over the network with low complexity. Successful exploitation allows injection and execution of arbitrary operating system commands, potentially leading to limited impacts on confidentiality, integrity, and availability, as reflected in the CVSS metrics.
Advisories from sources like VulDB and a GitHub issue tracker confirm the vulnerability, noting that a public exploit is available and may be in use. The vendor has stated that the Vigor 300B is end-of-life (EoL) and will not receive a patch, emphasizing that this is an authenticated issue affecting only unsupported products.
In context, this vulnerability highlights risks in legacy network devices, where public exploits increase the likelihood of targeted attacks on unpatched, EoL hardware still in use.
Details
- CWE(s)