CVE-2023-1009: DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal
UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Other sources
A vulnerability classified as problematic has been found in DrayTek Vigor 2960 1.5.1.4. Affected is the function sub1DF14 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-1009?
The severity of CVE-2023-1009 is medium with a severity value of 5.5.
What is the affected software for CVE-2023-1009?
The affected software for CVE-2023-1009 is DrayTek Vigor 2960 1.5.1.4 firmware.
How does CVE-2023-1009 affect DrayTek Vigor2960?
CVE-2023-1009 allows for path traversal in the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi in DrayTek Vigor2960 1.5.1.4.
Is DrayTek Vigor2960 1.5.1.4 vulnerable to CVE-2023-1009?
Yes, DrayTek Vigor2960 1.5.1.4 is vulnerable to CVE-2023-1009.
How can I fix CVE-2023-1009 in DrayTek Vigor2960?
To fix CVE-2023-1009 in DrayTek Vigor2960, update to a version of the firmware that addresses the vulnerability.