CVE-2026-129453

DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overflow

View on CVE.org
Published Nov 15, 2026 CVSS 4.0 · 9.4 Critical EPSS n/a KEV · Not listed
Description
A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

Analysis

AI-generated

Technical impact

The vulnerability is a heap-based buffer overflow within the check_file_exist function of the /cgi-bin/mainfunction.cgi component in DrayTek Vigor2960 firmware. By manipulating the upload_name argument, an attacker can overwrite memory on the heap and achieve arbitrary code execution. The vulnerability is exploitable over the network, and an attacker can trigger it remotely by sending a crafted request to the vulnerable CGI script.

Affected Systems

The affected system is the DrayTek Vigor2960 router running firmware version 1.5.1.6. The vendor indicates that firmware 1.5.1.7 resolves the issue, so clients of this product and firmware revision should coordinate an upgrade. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS base score of 9.4 reflects a high severity and indicates that remote code execution is possible without authentication. The EPSS score is not available, suggesting that current exploitation likelihood data is missing, but the existence of a public exploit means the vulnerability is actively leveraged. The vulnerability is not currently listed in the CISA KEV catalog, yet the combination of a high CVSS score, remote exploitation potential, and documented public exploit makes it a critical risk for any exposed devices.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the router firmware to version 1.5.1.7 or later as released by DrayTek.
  • If an immediate firmware upgrade is impractical, restrict external network access to the /cgi-bin/mainfunction.cgi endpoint or block the upload_name parameter by using firewall rules or access control lists.
  • Monitor device logs for anomalous usage of the upload_name parameter and investigate any suspicious activity promptly.

Generated by OpenCVE AI on November 15, 2026 at 14:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Draytek vigor2960
Vendors & Products Draytek vigor2960
Type Values Removed Values Added
Description A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Title DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overflow
First Time appeared Draytek
Draytek vigor2960 Firmware
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Vendors & Products Draytek
Draytek vigor2960 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 9.9, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Nov 15, 2026, 1:30 PM
Reserved
Nov 14, 2026, 6:12 PM

View source JSON

No data.

Status
Deferred
Published
Nov 15, 2026, 2:17 PM
Modified
Nov 15, 2026, 2:17 PM

View source JSON

No data.

Updated
Nov 15, 2026, 3:15 PM

JSON