| Title | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated jsonstatus File Operations and Multi-Sink Command |
|---|
| Description | The interface is confirmed to expose at least these two high-impact behaviors:
An authenticated attacker can make action=jsonstatus delete a caller-chosen usefile path. This was verified on the real device with /var/status_system_interface.
An authenticated attacker can make action=jsonstatus execute a caller-chosen local script. This can be combined with DRV2960-0002's hidden upload primitive by placing a shell script into /data/apm/files/...jpg and then executing it through jsonstatus; the current PoC uses a reverse-shell script for validation.
With table=sslvpnuser, attacker-controlled usefile reaches five shell commands in sub_182B0. Invocation-gated PoCs independently confirmed all five physical sinks on the device, each yielding a root shell.
Affected path:
POST /cgi-bin/mainfunction.cgi with action=jsonstatus
Root cause:
Front-end controlled usefile, usescript, and option are inserted directly into shell-command templates without a privilege boundary.
Confirmed impact:
An authenticated attacker can delete a chosen file and, on this device, further execute a script that was previously planted through the hidden upload route. |
|---|
| Source | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0007-authenticated-jsonstatus-usefile-file-clobber |
|---|
| User | eqqie (UID 101441) |
|---|
| Submission | 09/19/2026 16:47 (1 month ago) |
|---|
| Moderation | 10/20/2026 07:50 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422666 [DrayTek Vigor2960 1.5.1.6 Revision 8218 CGI Interface mainfunction.cgi sub_182B0 usefile/usescript/option os command injection] |
|---|
| Points | 20 |
|---|