CVE-2026-129451

DrayTek Vigor2960 mainfunction.cgi app_guest_export path traversal

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Description
A flaw has been found in DrayTek Vigor2960 up to 1.5.1.6. This affects the function app_guest_export of the file /cgi-bin/mainfunction.cgi. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. The affected component should be upgraded. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Analysis

AI-generated

Technical impact

A path traversal flaw exists in the app_guest_export function of the mainfunction.cgi script on DrayTek Vigor2960 routers. By sending a crafted filename parameter, an unauthenticated remote attacker can read or delete arbitrary files on the device. The vulnerability does not provide direct code execution but enables manipulation of critical system files, potentially leading to further compromise if malicious firmware or configuration files are written.

Affected Systems

The flaw affects DrayTek Vigor2960 routers running firmware versions up to 1.5.1.6. Firmware 1.5.1.7 and later incorporate a fix that removes the traversal issue.

Risk and Exploitability

The high CVSS score of 9.4 reflects the serious impact of arbitrary file access. The exploit is triggered by simple HTTP requests to the web administration interface and publicly released exploits exist, demonstrating that attackers can target the device without authentication. The vulnerability is not listed in the CISA KEV catalog and an EPSS score is not available, but the availability of published exploits indicates a realistic risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the device firmware to version 1.5.1.7 or later.
  • If a firmware upgrade is not immediately possible, restrict or block external access to the router's web administration interface or confine it to a trusted internal network.
  • Continuously monitor web access logs for unusual filename values or repeated attempted directory traversals, and investigate any suspicious activity.

Generated by OpenCVE AI on November 15, 2026 at 13:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960
Type Values Removed Values Added
Description A flaw has been found in DrayTek Vigor2960 up to 1.5.1.6. This affects the function app_guest_export of the file /cgi-bin/mainfunction.cgi. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. The affected component should be upgraded. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Title DrayTek Vigor2960 mainfunction.cgi app_guest_export path traversal
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-22
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 12:15 PM
Reserved
Nov 14, 2026, 6:12 PM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 1:16 PM
Modified
Nov 15, 2026, 1:16 PM

View source JSON

No data.

Updated
Nov 15, 2026, 1:45 PM

JSON