CVE-2026-113395 in Vigor2960
Summary
by MITRE • 10/20/2026
A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
A critical path traversal vulnerability exists within the DrayTek Vigor2960 router firmware version 1.5.1.6 Revision 8218, specifically affecting the swmconfigupload component and its associated cgiEscape function located in the /cgi-bin/mainfunction.cgi file. This flaw arises from improper input validation when handling multipart form data arguments passed to the CGI script. The vulnerability allows an attacker to manipulate these inputs to traverse directory structures on the underlying operating system, potentially accessing or modifying files outside of the intended web root directory. Because this component is exposed via the network interface and processes user-supplied data without adequate sanitization, the attack vector is remote, requiring only network connectivity to the vulnerable device rather than local access or physical interaction with the hardware.
The technical nature of this flaw aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within file paths that can cause files to be located outside of the intended directory. In practical terms, an attacker leveraging this vulnerability could potentially read sensitive configuration files, such as those containing administrative credentials or network topology details, or overwrite critical system binaries and scripts if write permissions are granted in specific directories. The existence of a publicly released exploit significantly lowers the barrier for entry, enabling less sophisticated threat actors to compromise the integrity and confidentiality of devices running this specific firmware revision. This scenario is consistent with ATT&CK technique T1083: File and Directory Discovery, where adversaries explore file systems to gather information necessary for further exploitation or lateral movement within a network environment.
The operational impact of this vulnerability extends beyond simple data exfiltration depending on the execution context of the CGI process. If the web server runs with elevated privileges, successful exploitation could lead to remote code execution, allowing an attacker to gain full control over the router and use it as a pivot point for attacking other devices within the local network. This compromises not only the confidentiality of data passing through or stored on the device but also its availability and integrity. Given that DrayTek has designated this product line as End-of-Life with limited support, organizations relying on these devices face heightened risk due to reduced vendor responsiveness to emerging threats beyond major unauthenticated vulnerabilities. The lack of ongoing security patches means that once exploited, the vulnerability remains a persistent threat unless mitigated through alternative measures.
To mitigate this risk, immediate action is required for any systems still running version 1.5.1.6 Revision 8218 or earlier affected revisions. The primary remediation strategy recommended by the vendor is to upgrade the firmware to version 1.5.1.7, which addresses these security issues through improved input handling and validation logic within the cgiEscape function. However, given the end-of-life status of the Vigor2960 series, reliance on software updates alone may not be sustainable for long-term security posture. Organizations should consider implementing network segmentation to isolate legacy devices from critical infrastructure, restricting access to management interfaces via IP whitelisting or VPN tunnels rather than exposing them directly to untrusted networks. Additionally, deploying intrusion detection systems with signatures capable of identifying path traversal attempts can provide an additional layer of defense against exploitation while migration plans are executed to replace unsupported hardware with modern, actively maintained alternatives that adhere to current security standards and receive regular vendor support.