CVE-2026-113392 in Vigor2960
Summary
by MITRE • 10/20/2026
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The DrayTek Vigor2960 router running firmware version 1.5.1.6 Revision 8218 contains a critical path traversal vulnerability within its web management interface, specifically affecting the Apmupload component and the mainfunction.cgi script located at /cgi-bin/mainfunction.cgi. This flaw arises from insufficient validation of user-supplied input in the action argument, allowing an attacker to manipulate file paths through directory traversal sequences such as dot-dot-slash characters. By exploiting this weakness, a remote adversary can bypass intended access controls and read or write files outside the designated web root directory on the underlying operating system. This type of vulnerability is classically categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which highlights the failure to properly sanitize input before using it in file operations.
The operational impact of this vulnerability is severe due to its remote and unauthenticated nature. Since the exploit does not require prior authentication, any external actor with network connectivity to the router's management interface can leverage this flaw to access sensitive system files, potentially including configuration backups, credential stores, or other critical infrastructure data. The fact that a public proof-of-concept exists significantly lowers the barrier for exploitation, increasing the likelihood of automated attacks by threat actors scanning for vulnerable devices on the internet. This aligns with ATT&CK technique T1083: File and Directory Discovery, where adversaries explore the file system to gather information necessary for further compromise or data exfiltration.
It is crucial to note that this vulnerability affects a product line that has reached its End of Support (EoS) status according to DrayTek. The vendor explicitly states that version 1.5.1.7 corrected many security issues, but support for the Vigor2960 series is now limited primarily to major unauthenticated vulnerabilities. While this specific path traversal issue may fall within their scope for review due to its remote and unauthenticated nature, reliance on legacy hardware with diminishing vendor support poses inherent risks. Organizations still operating these devices should recognize that while an upgrade to version 1.5.1.7 is technically advised by the manufacturer, the broader lifecycle status means long-term security guarantees are no longer provided in the same manner as supported products.
To mitigate this risk immediately, administrators should apply the recommended firmware update to version 1.5.1.7 if available and compatible with their specific hardware revision. However, given the EoS status of the Vigor2960 series, a more robust long-term mitigation strategy involves network segmentation and access control lists that restrict management interface access to trusted internal IP addresses only. Additionally, deploying intrusion detection systems capable of identifying path traversal patterns in HTTP requests can provide an additional layer of defense against exploitation attempts from external networks until the hardware can be replaced with supported alternatives.