DrayTek Vigor2960 CVE-2026-113392

Exploitation requires an authenticated session on the Vigor2960 web management interface (CVSS PR:L; the vendor's exploit case is explicitly labeled 'authenticated'), and the request must target the Apmupload functionality of /cgi-bin/mainfunction.cgi with a manipulated 'action' argument. No user interaction is needed (UI:N) and the management interface must be network-reachable to the attacker (AV:N). Key limiting factors: valid credentials/session are mandatory, and the affected firmware is 1.5.1.6 Revision 8218 - devices upgraded to 1.5.1.7 are not vulnerable. The product is End-of-Support, so unpatched devices will persist, but the authentication requirement substantially narrows realistic exposure.

This is a low-priority issue for most defenders despite being remotely reachable. The CVSS 4.0 base score is only 2.1, consistent with the vector AV:N/AC:L/AT:N/PR:L/UI:N and uniformly Low impacts (VC:L/VI:L/VA:L). The decisive limiter is PR:L - exploitation requires valid authentication, and the vendor's own exploit reference explicitly names this 'authenticated-apmupload-path-traversal-clobber,' corroborating that an authenticated session is a prerequisite. Exploitation maturity in the vector is E:P (Proof-of-Concept), which aligns with the input signal that public exploit code exists. There is no KEV listing and no EPSS value provided, so there is no evidence of active or widespread exploitation - only that POC code is available. Signals are internally consistent (low CVSS + authenticated + POC-only + no KEV all point the same direction), so this is a genuinely low-severity, authenticated post-login path traversal rather than a high-urgency flaw. The one caveat worth stating: the vendor notes Vigor2960 is End-of-Support and that only 'major issues (e.g. unauthenticated vuln.)' will be reviewed going forward, so an authenticated bug like this may not receive further vendor scrutiny even if impact is later found to be greater.

An attacker who already holds valid credentials (or has hijacked a session) on the DrayTek Vigor2960 web management interface sends a crafted request to /cgi-bin/mainfunction.cgi targeting the Apmupload component and manipulates the 'action' argument to escape the intended directory. Because this is a path traversal with file-clobber potential, the attacker can read or overwrite files outside the intended path on the appliance. Public proof-of-concept exploit code for this exact case is available on GitHub, lowering the effort to reproduce it.