| Title | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated swmconfigupload Field-Name Path Traversal and Comm |
|---|
| Description | /swmconfigupload uses the multipart field name, not the uploaded filename, as the later mv destination. The field name permits both path-traversal arbitrary file clobbering and single-quote escape leading to arbitrary root command execution at sink 8168.
Affected path(s):
POST /cgi-bin/mainfunction.cgi/swmconfigupload
Root cause:
The multipart field name passes only through cgiEscape(), which does not remove . and /, and then directly enters the final mv target-path construction.
Confirmed impact:
Because this CGI runs as root, an authenticated attacker can write uploaded content into effectively arbitrary target paths in the device filesystem through the field name rather than the file name; /var/status_system_interface has been verified on the real device.
## Vendor Confirmation
The vulnerability has been officially confirmed. The email is available at: https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/vendor_confirm
The official fix for this vulnerability has been released: https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip |
|---|
| Source | ⚠️ https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0012-authenticated-swmconfigupload-fieldname-path-traversal-clobber |
|---|
| User | eqqie (UID 101441) |
|---|
| Submission | 09/19/2026 16:53 (1 month ago) |
|---|
| Moderation | 10/20/2026 07:51 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422671 [DrayTek Vigor2960 1.5.1.6 Revision 8218 swmconfigupload mainfunction.cgi cgiEscape multipart path traversal] |
|---|
| Points | 20 |
|---|