CVE-2026-113394: DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects DrayTek Vigor2960 devices running version 1.5.1.6 Revision 8218. The vendor states that affected products are no longer supported by the maintainer.
What access does an attacker need to exploit this?
The attack can be initiated remotely and has low attack complexity, but it requires low-level privileges. No user interaction is required.
Is public exploit code available?
Yes. The exploit is publicly available and might be used.
What should teams do if they cannot immediately patch?
Prioritize removing affected Vigor2960 devices from exposure and plan replacement, since the product is end of support and the vendor indicates that only major issues receive review. Version 1.5.1.7 is stated to have corrected many security issues, but the provided information does not specifically confirm a fix for this issue.