| Title | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Hidden APM Upload Authentication Bypass Leading to Restricted Ar |
|---|
| Description | ## Executive Summary
/apmcfgupload and /cvmcfgupload do not reuse the normal administrator cookie session gate. Instead, they accept a separate arithmetic session= check. The current PoC confirms that this hidden path can upload an AP configuration file and an arbitrary JPG file into the device APM file area without going through the normal administrator session flow.
Affected path(s):
POST /cgi-bin/mainfunction.cgi/apmcfgupload
POST /cgi-bin/mainfunction.cgi/cvmcfgupload
Root cause:
The hidden upload routes replace the normal HTTP_COOKIE -> session administrator gate with a QUERY_STRING session= time-window check.
Confirmed impact:
An unauthenticated request can enter the protected upload handler and write attacker-supplied files under /data/apm/files/....
## Preconditions
AP Management must be enabled on the device.
The current test source IP must be allowed by the Access Control list.
## Vendor Confirmation
The vulnerability has been officially confirmed. The email is available at: https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/vendor_confirm
The official fix for this vulnerability has been released: https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip |
|---|
| Source | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0002-auth-alt-session-upload |
|---|
| User | eqqie (UID 101441) |
|---|
| Submission | 09/19/2026 16:43 (1 month ago) |
|---|
| Moderation | 10/20/2026 07:32 (1 month later) |
|---|
| Status | Duplicate |
|---|
| VulDB entry | 157503 [DrayTek Vigor3900/Vigor2960/Vigor300B up to 1.5.0 cvmcfgupload Shell Metacharacter os command injection] |
|---|
| Points | 0 |
|---|