CVE-2026-129450

DrayTek Vigor2960 mainfunction.cgi sub_1E084 path traversal

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Description
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub_1E084 of the file /cgi-bin/mainfunction.cgi?action=doWebBackup. The manipulation of the argument option results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 1.5.1.7 can resolve this issue. You should upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Analysis

AI-generated

Technical impact

A flaw in the sub_1E084 function of the DrayTek Vigor2960 web backup routine permits an attacker to manipulate the option argument and trigger a path traversal. This weakness, classified as CWE‑22, enables a remote operator to write or overwrite arbitrary files on the device’s file system, potentially compromising the router’s firmware and data integrity.

Affected Systems

The vulnerability affects DrayTek Vigor2960 routers running firmware version 1.5.1.6. Upgrading to firmware 1.5.1.7 eliminates the issue.

Risk and Exploitability

The CVSS score of 9.4 indicates a high severity risk. The EPSS score is not available, so the exact exploitation likelihood cannot be quantified, but the presence of a public exploit and the lack of a KEV listing suggest that the risk remains significant. A remote attacker can exploit the web interface without client‑side interaction, and the path traversal can be used to replace critical configuration or backup files, thereby degrading confidentiality, integrity, or availability of the router and potentially the network it supports.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied firmware update to version 1.5.1.7, which removes the path traversal flaw.
  • Verify that web backup functionality no longer permits arbitrary file writes by testing with both valid and malformed option values.
  • Disable or restrict the web backup feature for devices that do not require remote backups and ensure that administrative accounts use strong, unique passwords to limit potential exploitation from compromised credentials.

Generated by OpenCVE AI on November 15, 2026 at 13:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960
Type Values Removed Values Added
Description A vulnerability was detected in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub_1E084 of the file /cgi-bin/mainfunction.cgi?action=doWebBackup. The manipulation of the argument option results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 1.5.1.7 can resolve this issue. You should upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Title DrayTek Vigor2960 mainfunction.cgi sub_1E084 path traversal
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-22
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 11:45 AM
Reserved
Nov 14, 2026, 6:10 PM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 12:17 PM
Modified
Nov 15, 2026, 12:17 PM

View source JSON

No data.

Updated
Nov 15, 2026, 1:45 PM

JSON