Read the docs
TI-2026-76869 Aliases CVE-2026-113392GHSA-3r48-3g8f-54w9

Path traversal in DrayTek Vigor2960 Apmupload mainfunction.cgi

Priority MEDIUM 57CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DrayTek Vigor2960 1.5.1.6 Revision 8218 is affected. The Apmupload component does not restrict the action argument of /cgi-bin/mainfunction.cgi to the intended directory, which is a path traversal flaw (CWE-22). A remote attacker with low privileges can exploit it, and a public exploit is linked in the references. The vendor states that the Vigor2960 is end of support with limited support, and this vulnerability only affects products no longer supported by the maintainer.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Vigor2960 (DrayTek): 1.5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor29601.5.1.6 Revision 82181.5.1.7Patch availableCNA
  • Vigor2960 VendorDrayTek Affected 1.5.1.6 Revision 8218 Fixed in 1.5.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*——DrayTek
  • cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* Versions — — ·DrayTek

Remediation

Upgrade DrayTek Vigor2960 to version 1.5.1.7, which resolves this issue. The vendor notes that the Vigor2960 has limited support, so only major issues are reviewed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vigor2960 (DrayTek) Fixed in 1.5.1.7

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113392
  2. 2026-10-20 Alias added: GHSA-3r48-3g8f-54w9
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-10-20 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences