LastPatch
EN

Is the DrayTek Vigor2960 still getting security updates?

Security updates for the DrayTek Vigor2960 end on 9 December 2026. Plan a replacement.

The date after which a device gets no more security fixes is also called its end of life (EOL) or end of support.

Support ends soon

Security updates end on

9 December 2026

27 days left on 12 November 2026

Device
DrayTek Vigor2960 (router)
Basis
Official end date published by the manufacturer.
As written
EoL Date 09/12/2026
Source
DrayTek UK Product Lifecycle (UK statement)

What to do. Attackers are using known flaws in this model. Install the latest firmware now, then keep automatic updates on. If your hardware version is past its end of support, replace it.

Vulnerabilities attackers are using

The U.S. cybersecurity agency (CISA) lists these vulnerabilities as actively exploited. Its description names the affected hardware versions when they are known.

  • CVE-2020-15415: DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
  • CVE-2020-8515: DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
  • CVE-2024-12987: DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.

Support timeline

2025202620272028All versionsToday
Security updates per hardware version, to scale. The bar ends on the manufacturer's date.

Questions

Is the DrayTek Vigor2960 still getting security updates?

Security updates for the DrayTek Vigor2960 end on 9 December 2026. Plan a replacement.

Is the DrayTek Vigor2960 affected by vulnerabilities attackers are using?

Yes. The CISA catalogue of exploited vulnerabilities lists CVE-2020-15415, CVE-2020-8515, CVE-2024-12987 for this model. Check the affected hardware versions and install the latest firmware, or replace the device if it is no longer supported.

What does end of life mean for the DrayTek Vigor2960?

After its end of life, the DrayTek Vigor2960 receives no more security fixes from DrayTek. It keeps working, but any vulnerability found later stays open, which makes it an easy target once attackers know about it.

Where does this date come from?

From the manufacturer: DrayTek UK Product Lifecycle. Each date is shown exactly as published.

Every DrayTek device   Routers from every brand