CVE-2026-113394 in Vigor2960
Summary
by MITRE • 10/20/2026
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
The identified vulnerability resides within the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218, specifically affecting the setSWMProfile function located in the /cgi-bin/mainfunction.cgi script. This flaw is classified as a path traversal vulnerability, which allows an attacker to manipulate file system operations by injecting malicious directory sequences into input arguments. The core technical issue stems from insufficient validation of user-supplied data passed to the setSWMProfile function. When this argument is processed, the application fails to properly sanitize or restrict the paths being accessed, enabling the execution of arbitrary commands or access to sensitive files outside the intended directory structure. This type of flaw typically falls under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, as it violates the principle that user input should never be directly used in file system operations without rigorous validation against an allowlist of permitted paths.
The operational impact of this vulnerability is severe due to its remote and unauthenticated nature. An attacker can initiate the attack from any network location with connectivity to the router's management interface, requiring no prior authentication credentials. This characteristic aligns with ATT&CK technique T1059: Command and Scripting Interpreter or potentially T1083: File and Directory Discovery, depending on the specific payload delivered through the path traversal vector. Because the exploit is publicly available, automated scanning tools and threat actors can readily leverage this weakness to compromise the device. The ability to traverse paths often leads to further exploitation stages such as reading configuration files containing plaintext passwords or SSH keys, writing malicious scripts to execute arbitrary code with root privileges, or disrupting service availability by deleting critical system files.
It is crucial to note that the DrayTek Vigor2960 model has reached its End of Support (EoS) status according to vendor communications. The manufacturer indicates that version 1.5.1.7 corrected many security issues but emphasizes that support for this specific product line is now limited, with only major unauthenticated vulnerabilities being reviewed. Consequently, while the vulnerability itself may be acknowledged as a significant risk, users of older revisions like 8218 are operating on deprecated firmware without guaranteed patches or ongoing security updates from DrayTek. This lack of vendor support significantly increases the exposure window and reduces the likelihood of receiving timely remediation guidance for this specific revision.
Mitigation strategies must account for both technical controls and organizational policy given the EoS status. Since patching to a supported version is not an option, network segmentation becomes paramount. The router should be isolated from untrusted networks such as the public internet if possible, or strictly firewalled to allow management access only from specific trusted IP addresses using strong authentication protocols like SSH with key-based login rather than passwords. Additionally, disabling unnecessary CGI scripts and web services can reduce the attack surface. Organizations relying on this hardware must conduct a thorough risk assessment to determine if the residual risk is acceptable given the lack of vendor support. If the device handles sensitive data or critical infrastructure functions, immediate replacement with supported equipment is strongly recommended to ensure ongoing security posture integrity.