DrayTek Vigor2960 up to 1.5.1.6 mainfunction.cgi sub_14914 swmconfigupload command injection

Summaryinfo

A vulnerability, which was classified as very critical, was found in DrayTek Vigor2960 up to 1.5.1.6. Affected by this issue is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload results in command injection. This vulnerability is known as CVE-2026-129449. It is possible to launch the attack remotely. Furthermore, an exploit is available. You should upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Detailsinfo

A vulnerability was found in DrayTek Vigor2960 up to 1.5.1.6. It has been classified as very critical. Affected is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload with an unknown input leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-129449. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details and a public exploit are known. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/14/2026). The MITRE ATT&CK project declares the attack technique as T1202.

The exploit is shared for download at github.com. It is declared as proof-of-concept. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Upgrading to version 1.5.1.7 eliminates this vulnerability. The upgrade is hosted for download at fw.draytek.com.tw.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• DrayTek

Name

• Vigor2960

Version

• 1.5.1.0
• 1.5.1.1
• 1.5.1.2
• 1.5.1.3
• 1.5.1.4
• 1.5.1.5
• 1.5.1.6

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1044957: DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) Authenticated swmconfigupload Field-Name Command Injection (by eqqie)

Once again VulDB remains the best source for vulnerability data.

Discussion