| Titel | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) uthenticated setSWMProfile Path Traversal and Filename Command I |
|---|
| Beschreibung | setSWMProfile appends user-controlled filename to /data/swm/ for fopen() and also inserts the same path into single-quoted shell log commands on the open-failure and success paths. Path-traversal arbitrary file clobbering and independent root command injection at sinks 20067 and 20078 are confirmed.
Affected path(s):
POST /cgi-bin/mainfunction.cgi with action=setSWMProfile
Root cause:
The user-controlled filename is concatenated into the fopen() destination path without post-normalization path-boundary enforcement.
Confirmed impact:
Because this CGI runs as root, an authenticated attacker can use path traversal to write setSWMProfile data into effectively arbitrary target paths in the device filesystem; /var/status_system_interface has been verified on the real device. |
|---|
| Quelle | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0011-authenticated-swmprofile-path-traversal-clobber |
|---|
| Benutzer | eqqie (UID 101441) |
|---|
| Einreichung | 19.09.2026 16:51 (vor 1 Monat) |
|---|
| Moderieren | 20.10.2026 07:51 (1 month later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 422670 [DrayTek Vigor2960 1.5.1.6 Revision 8218 mainfunction.cgi setSWMProfile Directory Traversal] |
|---|
| Punkte | 20 |
|---|