DrayTek Vigor2960 vulnerabilities

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the ruequest_certificate function in /cgi-bin/mainfunction.cgi (IPsec Handler component) mishandles the option argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the rename_table function in /cgi-bin/mainfunction.cgi (Rename Table Handler component) mishandles the newtable argument, enabling command injection. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the cgiEscape function in /cgi-bin/mainfunction.cgi (swmconfigupload component) mishandles the multipart argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the setSWMProfile function in /cgi-bin/mainfunction.cgi mishandles the setSWMProfile argument, enabling path traversal. The attack can be launched remotely and a public exploit exists. The product is end-of-support (EoS).

DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.