This vulnerability in DrayTek Vigor2960 firmware allows an attacker to manipulate the upload_path and upload_name parameters in the mainfunction.cgi script, resulting in unrestricted file uploads. The weakness stems from improper access control (CWE-284) and lack of input validation for uploaded files (CWE-434). By uploading malicious or overwrite files, an adversary can compromise the integrity of the device and potentially execute arbitrary code or disrupt services, as the firmware does not restrict which files may be stored or executed.

The affected product is the DrayTek Vigor2960 router, specifically firmware version 1.5.1.6 Revision 8218. Users running this firmware on any Vigor2960 device are vulnerable. The vendor has released version 1.5.1.7 that corrects this issue; upgrading to that firmware removes the permission to upload arbitrary files.

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, so the current exploitation probability is unclear, but the vulnerability is listed as publicly disclosed and can be exploited from a remote location. Because the flaw does not require authentication, an attacker with network access can directly craft a request to /cgi-bin/mainfunction.cgi to upload or overwrite files. The firmware is no longer supported, and the vendor prioritizes only major unauthenticated flaws, so the risk remains high until the fix is applied.