DrayTek Vigor2960 CVE-2026-113394

Exploitation requires reaching the web management interface at /cgi-bin/mainfunction.cgi and invoking the setSWMProfile function, which per the CVSS vector (PR:L) and the PoC's own 'authenticated' designation demands valid low-privilege authentication to the Vigor2960 - it is NOT an unauthenticated flaw. The concrete prerequisite is network access to the device's HTTP(S) admin service plus a working low-privilege session/credential; the traversal is then triggered through the setSWMProfile argument. Limiting factors: required authentication meaningfully reduces exposure versus a pre-auth bug; impact is bounded to Low across confidentiality/integrity/availability; and the device is End-of-Service (fixed line referenced as 2960 1.5.1.7), so the realistic population is deployments that are both exposed and still running the vulnerable EoS firmware. Risk rises sharply where the management interface is exposed to the internet or shared networks.

This is a moderate-priority issue, not a top-tier emergency, and the signals are largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nevertheless requires existing low-level authentication (PR:L), capping severity at 5.3. The exploitation status is 'publicly available exploit code exists' - a GitHub proof-of-concept is referenced and the vector carries E:P (Proof-of-Concept), but there is NO CISA KEV listing and no EPSS score was provided, so there is no evidence of active, widespread exploitation; POC availability must not be conflated with exploitation in the wild. The 4.0 vector reports uniformly Low vulnerable- and subsequent-system impacts (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L) and the referenced PoC is characterized as a 'clobber' (file-overwrite) path traversal, which is an integrity-leaning primitive rather than full compromise. The single most important mitigating factor is that this product is End-of-Service: the vendor states Vigor2960 is EoS with limited support and that 1.5.1.7 already corrected many issues, so defenders should treat this as a 'retire/replace or isolate' problem rather than purely a patch-and-move-on one. Net: real but bounded risk, gated by authentication and by shrinking real-world deployment.

An attacker who already holds low-privilege credentials (or a session) on an internet-exposed or network-adjacent Vigor2960 sends a crafted request to /cgi-bin/mainfunction.cgi invoking the setSWMProfile function with a manipulated setSWMProfile argument containing directory-traversal sequences. Because the path is not sanitized, the attacker reads or overwrites files outside the intended profile directory, as demonstrated by the publicly available 'authenticated SWM profile path traversal clobber' proof-of-concept on GitHub. No user interaction is required and the attack is low-complexity once authenticated.