DrayTek Vigor2960 CVE-2026-113393

Requires an authenticated session (PR:L) on the DrayTek Vigor2960 web management interface, after which the attacker reaches the commonupload function of /cgi-bin/mainfunction.cgi and manipulates the upload_path and upload_name parameters to perform an unrestricted/arbitrary file upload (CWE-434), specifically arbitrary file clobber per the public case. LIMITING FACTORS: valid credentials are mandatory (no unauthenticated path), the flaw is specific to firmware 1.5.1.6 Revision 8218 on the Vigor2960, and the device is end-of-sale with only v1.5.1.7 remediating it - exposure is confined to environments still running the vulnerable firmware with the web interface reachable by the attacker.

This is a moderate-risk, authenticated file-upload flaw rather than a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) confirms network-reachable, low-complexity exploitation but requires at least low-level privileges (PR:L), meaning a valid authenticated session on the Vigor2960 web management interface is a prerequisite - this materially lowers mass-exploitation potential versus an unauthenticated flaw. Impact is bounded: all three impact metrics are Low (VC:L/VI:L/VA:L), and the public exploit case is explicitly labeled 'authenticated-commonupload-arbitrary-file-clobber,' indicating arbitrary file overwrite/clobber rather than confirmed remote code execution, which is consistent with the modest 5.3 score. A public POC exists (E:P / GitHub), but there is NO CISA KEV listing and NO EPSS score provided in the input, so exploitation probability cannot be quantified and there is no evidence of active in-the-wild use - the POC and active-exploitation signals must not be conflated. Net: real but secondary priority, elevated by EoS status (DrayTek states the 2960 is end-of-sale with only major/unauthenticated issues reviewed), which means residual authenticated issues like this may linger unpatched in the field.

An attacker who already holds valid (even low-privileged) credentials to the Vigor2960 web administration interface sends a crafted request to /cgi-bin/mainfunction.cgi against the commonupload component, manipulating the upload_path/upload_name arguments to write or overwrite files at an attacker-chosen location on the device. A public proof-of-concept exists (yikesoftware DRV2960-0010), lowering the skill barrier; low attack complexity (AC:L) and no user interaction make the authenticated step the main gate.