A path traversal flaw exists in the cgiEscape function of the swmconfigupload component of DrayTek Vigor2960 firmware 1.5.1.6. By manipulating the multipart argument, an attacker can cause the device to write files to arbitrary locations on the file system, potentially overwriting critical configuration files or inserting malicious code. The capability is exposed through a remote request to the mainfunction.cgi endpoint, which means an attacker does not require local access to the device. The resulting compromise could allow the attacker to alter device behavior or gain persistent access.

The vulnerability affects DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218. The affected firmware is no longer supported, and the vendor has released version 1.5.1.7, which contains the necessary fix. Replacement or upgrade is required for any affected units.

The CVSS score of 5.3 indicates moderate severity, and the exploit is publicly available. Although the EPSS score is not listed, the lack of KEV inclusion does not mitigate the risk of exploitation. Because the flaw allows remote file writes, once exploited an attacker could gain full control of the router’s configuration and potentially pivot to other devices on the network. The attack vector is inferred to be remote HTTP access to the router’s management interface, possibly from any IP on the Internet that can communicate with the device’s LAN or WAN port.