Read the docs
TI-2026-76872 Aliases CVE-2026-113395GHSA-jrpm-fx68-c8j4

Path traversal in DrayTek Vigor2960 swmconfigupload cgiEscape

Priority MEDIUM 57CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

DrayTek Vigor2960 from 1.5.1.6 Revision 8218 before 1.5.1.7 is affected. The cgiEscape function in /cgi-bin/mainfunction.cgi does not properly handle the multipart argument, which allows path traversal (CWE-22). A remote attacker with low privileges can exploit this flaw. A public exploit has been released.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. The affected component should be upgraded. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Vigor2960 (DrayTek): 1.5.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrayTekVigor29601.5.1.6 Revision 82181.5.1.7Patch availableCNA
  • Vigor2960 VendorDrayTek Affected 1.5.1.6 Revision 8218 Fixed in 1.5.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*——DrayTek
  • cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* Versions — — ·DrayTek

Remediation

Upgrade DrayTek Vigor2960 to version 1.5.1.7, which fixes this issue. The vendor states that the Vigor2960 is end of support with limited support, and that only major issues, such as unauthenticated vulnerabilities, are reviewed.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Vigor2960 (DrayTek) Fixed in 1.5.1.7

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113395
  2. 2026-10-20 Alias added: GHSA-jrpm-fx68-c8j4

References

Exploit 1

Patch 1

  • TI-2020-12150 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06834 DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-12038 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection KEVCVSS 4.0MEDIUM 6.9
  • TI-2021-03424 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2021-03423 Path traversal in Draytek VigorConnect KEVCVSS 3.1HIGH 7.5
  • TI-2024-34310 In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into… CVSS 3.1CRITICAL 9.8
See all 184 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences