CVE-2026-113393 in Vigor2960
Summary
by MITRE • 10/20/2026
A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_name can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.5.1.7 is capable of addressing this issue. It is advisable to upgrade the affected component. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The DrayTek Vigor2960 router, specifically firmware version 1.5.1.6 Revision 8218, contains a critical security flaw within its web management interface component known as commonupload. This vulnerability centers on improper input validation and access control mechanisms governing the file upload functionality exposed through the /cgi-bin/mainfunction.cgi endpoint. The core technical deficiency lies in how the system processes arguments related to upload_path and upload_name. When these parameters are manipulated by an attacker, the application fails to adequately restrict or sanitize the destination directory for uploaded files. This lack of strict path validation allows a remote actor to bypass intended file storage restrictions, effectively achieving unrestricted file upload capabilities on the target device.
From a technical perspective, this flaw is classified under CWE-434, which describes an Unrestricted Upload of File with Dangerous Type, and often intersects with CWE-22 for Improper Limitation of a Pathname to a Restricted Directory. The absence of robust server-side checks means that malicious actors can craft specific HTTP requests containing carefully constructed filenames or path traversals sequences. By exploiting this logic error, the attacker gains the ability to write arbitrary files to locations on the router's filesystem where they typically would not have permission. This capability is particularly severe in embedded network devices because it often serves as a precursor to more destructive attacks, such as remote code execution if the uploaded file can be executed or included by other system processes.
The operational impact of this vulnerability is significant due to its remote exploitability and public disclosure status. Since the attack vector requires only network access to the management interface, an adversary with knowledge of the router's IP address can attempt exploitation without prior authentication in many configurations, aligning with MITRE ATT&CK technique T1505.003 (Web Shell: Web Shell). The successful exploitation allows for complete compromise of the device integrity. An attacker could install persistent backdoors, intercept network traffic, or use the compromised router as a pivot point to attack other devices on the internal LAN. Given that this is an embedded system with limited computational resources and specialized operating systems, remediation after initial compromise can be difficult without full factory resets, which may disrupt critical network operations.
Mitigation strategies primarily focus on version management despite the complex support status of the product line. The vendor has released firmware version 1.5.1.7, which explicitly addresses this security issue by correcting the flawed upload handling logic. Organizations relying on DrayTek Vigor2960 hardware are strongly advised to upgrade immediately if they have not already done so. However, it is crucial for administrators to note that the Vigor2960 series has reached its End of Support (EoS) phase with limited vendor support. The manufacturer indicates that only major issues affecting unauthenticated vulnerabilities will be reviewed in future updates. Consequently, while upgrading mitigates this specific CVE, long-term security posture requires evaluating whether continued reliance on an unsupported platform poses unacceptable risk to the broader network infrastructure.
In environments where immediate upgrade is not feasible due to operational constraints or hardware limitations, compensating controls should be implemented. These include restricting access to the management interface via IP whitelisting and firewall rules to ensure only trusted administrative stations can reach the CGI endpoints. Additionally, disabling unnecessary services such as UPnP and remote web management from external networks reduces the attack surface significantly. Security monitoring tools should also be configured to detect anomalous HTTP POST requests targeting upload-related paths or unusual file creation patterns on the device filesystem. Ultimately, while patching remains the primary defense against this unrestricted upload vulnerability, the EoS status of the Vigor2960 necessitates a strategic review of network architecture to replace legacy equipment with supported alternatives that receive regular security updates and maintain compliance with modern cybersecurity standards.