| 제목 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Hidden APM Upload Authentication Bypass Leading to Restricted Ar |
|---|
| 설명 | ## Executive Summary
/apmcfgupload and /cvmcfgupload do not reuse the normal administrator cookie session gate. Instead, they accept a separate arithmetic session= check. The current PoC confirms that this hidden path can upload an AP configuration file and an arbitrary JPG file into the device APM file area without going through the normal administrator session flow.
Affected path(s):
POST /cgi-bin/mainfunction.cgi/apmcfgupload
POST /cgi-bin/mainfunction.cgi/cvmcfgupload
Root cause:
The hidden upload routes replace the normal HTTP_COOKIE -> session administrator gate with a QUERY_STRING session= time-window check.
Confirmed impact:
An unauthenticated request can enter the protected upload handler and write attacker-supplied files under /data/apm/files/....
## Preconditions
AP Management must be enabled on the device.
The current test source IP must be allowed by the Access Control list.
## Vendor Confirmation
The vulnerability has been officially confirmed. The email is available at: https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/vendor_confirm
The official fix for this vulnerability has been released: https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip |
|---|
| 원천 | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0002-auth-alt-session-upload |
|---|
| 사용자 | eqqie (UID 101441) |
|---|
| 제출 | 2026. 09. 19. PM 04:43 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 20. AM 07:32 (1 month later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 157503 [DrayTek Vigor3900/Vigor2960/Vigor300B 까지 1.5.0 cvmcfgupload Shell Metacharacter 권한 상승] |
|---|
| 포인트들 | 0 |
|---|