CVE-2026-113395
HighCVSS 7.4Summary
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the cgiEscape function in /cgi-bin/mainfunction.cgi (swmconfigupload component) mishandles the multipart argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
Risk Assessment
A remote attacker can read or write files outside the intended directory, potentially leading to data disclosure or device compromise.
Recommendation
Upgrade to version 1.5.1.7, which fixes this issue. Since the product is EoS, consider migrating to a supported device.
Other vulnerabilities in DrayTek Vigor2960
See all- CVE-2026-113397High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler component) mishandles the option argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113396High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the rename_table function in /cgi-bin/mainfunction.cgi (Rename Table Handler component) mishandles the newtable argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113394High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the setSWMProfile function in /cgi-bin/mainfunction.cgi mishandles the setSWMProfile argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).
- CVE-2026-113393Medium
DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.
- CVE-2026-113392High
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.
- CVE-2026-113391Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.
- CVE-2026-113390Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.
- CVE-2026-113389Critical
In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.
Original NVD description (English source)
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS