DrayTek Vigor2960 CVE-2026-113395

Requires an authenticated low-privilege session on the Vigor2960 web management interface (PR:L); the attacker then reaches the swmconfigupload component by POSTing a multipart request to /cgi-bin/mainfunction.cgi, where the cgiEscape function fails to sanitize directory-traversal sequences in the multipart field name, permitting path traversal and file clobbering. Limiting factors: valid credentials are mandatory, the web management interface must be network-reachable (typically LAN-side and not WAN-exposed in default deployments), and only the End-of-Sale Vigor2960 at firmware 1.5.1.6 Revision 8218 is affected - upgrading to 1.5.1.7 removes the flaw.

This is a moderate, not top-tier, priority. The CVSS 4.0 base vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (Medium) and the E:P threat metric reflects only a proof-of-concept - consistent with the input signal that publicly available exploit code exists but there is NO CISA KEV listing. The decisive limiting factor is PR:L: exploitation requires valid (low-privilege) authenticated access to the web management interface, which is corroborated by the exploit case name ('authenticated-swmconfigupload-fieldname-path-traversal-clobber'). This rules out trivial, mass pre-auth exploitation and points to targeted use by an actor who already holds credentials or has chained another flaw. The description states the attack can be 'launched remotely' but does NOT mention authentication; the CVSS vector (PR:L) and the exploit title are the authoritative signals and confirm authentication IS required, so treat 'remote' as network-reachable rather than unauthenticated. Technical impact is uniformly Low (VC:L/VI:L/VA:L), i.e. partial read/overwrite via path traversal rather than full compromise. No EPSS score was provided in the input, so the empirical exploitation-probability signal is MISSING and cannot be weighed. Net: a real but authentication-gated issue on an End-of-Sale product - patch it, but it does not warrant the emergency response a pre-auth RCE would.

An attacker with valid low-privilege web-UI credentials (or who has pivoted onto the management network) sends a crafted multipart request to the swmconfigupload handler in /cgi-bin/mainfunction.cgi, manipulating the field name so the cgiEscape routine fails to sanitize path separators. This lets the attacker read or overwrite ('clobber') files outside the intended directory on the EoS Vigor2960. Public proof-of-concept exploit code for this exact case already exists on GitHub, lowering the effort to reproduce.