| Title | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated set_table JSONData Command Injection |
|---|
| Description | The jsondata accepted by action=set_table is deeply parsed, and the sectiontype field reaches later UCI/shell command construction. The current PoC confirms command execution on the real device by setting apmd.general.codexpoc=hit.
Affected path(s):
POST /cgi-bin/mainfunction.cgi with action=set_table
Root cause:
The parsed jsondata.sectiontype value is inserted into command construction and reaches system() without shell-safe isolation.
Confirmed impact:
An authenticated attacker can inject arbitrary shell commands through jsondata and execute them with the CGI process privileges on the device. |
|---|
| Source | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0006-authenticated-set-table-command-injection |
|---|
| User | eqqie (UID 101441) |
|---|
| Submission | 09/19/2026 16:45 (1 month ago) |
|---|
| Moderation | 10/20/2026 07:50 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422665 [DrayTek Vigor2960 1.5.1.6 Revision 8218 CGI Process mainfunction.cgi set_table sectiontype command injection] |
|---|
| Points | 20 |
|---|