The flaw is in the setSWMProfile handler of mainfunction.cgi. By supplying a crafted argument, an attacker can cause the device to resolve file paths outside the intended directory, allowing the upload or retrieval of arbitrary files on the device. The public exploit demonstrates this capability remotely, suggesting that an unauthenticated or low‑privilege user exposed to the router’s management interface can trigger the path traversal and potentially alter or exfiltrate sensitive configuration files.

The issue affects DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218. This firmware line is no longer supported; the vendor’s recommendation is to upgrade to 1.5.1.7 or newer, or to discontinue use of the product.

The CVSS score of 5.3 indicates a moderate severity. EPSS data is unavailable, so the current exploitation probability cannot be quantified, but the vulnerability is listed as publicly exploitable. The device is not in CISA’s KEV catalog. Attackers can exploit the path traversal from any network location that can reach the router’s local web interface, meaning that untrusted external traffic poses a risk if not properly segmented or blocked.