| Title | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) uthenticated setSWMProfile Path Traversal and Filename Command I |
|---|
| Description | setSWMProfile appends user-controlled filename to /data/swm/ for fopen() and also inserts the same path into single-quoted shell log commands on the open-failure and success paths. Path-traversal arbitrary file clobbering and independent root command injection at sinks 20067 and 20078 are confirmed.
Affected path(s):
POST /cgi-bin/mainfunction.cgi with action=setSWMProfile
Root cause:
The user-controlled filename is concatenated into the fopen() destination path without post-normalization path-boundary enforcement.
Confirmed impact:
Because this CGI runs as root, an authenticated attacker can use path traversal to write setSWMProfile data into effectively arbitrary target paths in the device filesystem; /var/status_system_interface has been verified on the real device. |
|---|
| Source | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0011-authenticated-swmprofile-path-traversal-clobber |
|---|
| User | eqqie (UID 101441) |
|---|
| Submission | 09/19/2026 16:51 (1 month ago) |
|---|
| Moderation | 10/20/2026 07:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422670 [DrayTek Vigor2960 1.5.1.6 Revision 8218 mainfunction.cgi setSWMProfile path traversal] |
|---|
| Points | 20 |
|---|