Vigor2960
Monthly
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows a low-privileged user with valid credentials to reach the web administration interface and supply a crafted language-upload filename that is executed as shell commands, compromising confidentiality, integrity, and availability of the device. This is a genuine but conditional priority: publicly available exploit code exists, but successful exploitation requires network reachability to the management interface and valid low-privilege credentials. DrayTek has released firmware 1.5.1.7, which the vendor indicates corrects this issue and other security problems in the end-of-sale Vigor2960 line.
OS command injection in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 allows authenticated, low-privilege attackers to execute arbitrary shell commands on the device through the web management interface. The flaw resides in the CGI handler /cgi-bin/mainfunction.cgi (function sub_182B0), where the usefile, usescript, and option parameters are passed to a shell without adequate sanitization. Publicly available exploit code exists, and the vendor has classified the Vigor2960 as End-of-Service with only limited support, so legacy deployments exposing the management interface are the primary exposure.
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 lets a low-privileged user of the web management interface run arbitrary OS commands by manipulating the sectiontype argument to set_table in /cgi-bin/mainfunction.cgi. Publicly available exploit code exists, but the attack requires valid credentials and network reachability to the HTTP(S) management service. The vendor has placed the Vigor2960 on end-of-support with limited maintenance, so replacement or mitigation is more realistic than waiting for a dedicated fix.
Authenticated command injection in the IPsec certificate-handling path of DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218 lets a low-privilege management user execute arbitrary OS commands on the device, fully compromising confidentiality, integrity and availability. Publicly available exploit code exists and maps directly to the flaw (DRV2960-0014), though no active exploitation is confirmed by CISA KEV. DrayTek has discontinued the Vigor2960 (EoS with limited support) and states it only reviews major issues such as unauthenticated flaws, making the availability of the 1.5.1.7 fix and a prompt upgrade the primary defense.
Authenticated path traversal in the End-of-Sale DrayTek Vigor2960 1.5.1.6 web management interface lets a low-privilege user manipulate the multipart field name processed by cgiEscape in /cgi-bin/mainfunction.cgi, enabling path traversal and file clobbering. The vendor fixed the issue in firmware 1.5.1.7, but public exploit code exists for the affected swmconfigupload component; exploitation still requires valid credentials and reachability to the management interface. No CISA KEV confirmation or EPSS score was included, so this should be treated as a moderate-priority authenticated issue rather than confirmed active exploitation.
Path traversal in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated low-privilege user to manipulate the setSWMProfile argument in /cgi-bin/mainfunction.cgi and reach files outside the intended directory. Publicly available exploit code exists, and the vendor states that 2960 firmware 1.5.1.7 corrected many security issues while noting the Vigor2960 is End-of-Service with limited support. The CVSS 4.0 score is 5.3 with Low confidentiality, integrity, and availability impact; risk increases where the web management interface is reachable from untrusted networks.
Authenticated remote attackers can exploit an unrestricted file-upload flaw in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 by manipulating the upload_path and upload_name parameters in the commonupload function of /cgi-bin/mainfunction.cgi, resulting in arbitrary file clobber on the device. Publicly available exploit code exists, but exploitation requires valid credentials and access to the web management interface, keeping the issue moderate-risk rather than an emergency. DrayTek addressed the flaw in firmware 1.5.1.7; because the Vigor2960 is end-of-sale with limited support, exposure is limited to units still running the vulnerable release.
Authenticated path traversal in DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) lets a user with a valid web-management session manipulate the 'action' argument in the Apmupload component of /cgi-bin/mainfunction.cgi to traverse paths and potentially clobber targeted files, with low confidentiality, integrity, and availability impact. The issue is remotely reachable but requires authentication and network access to the management interface, and the vendor has fixed it in firmware 1.5.1.7; publicly available exploit code exists, while no CISA KEV active-exploitation confirmation was provided. Because the Vigor2960 is end-of-support and unpatched devices may persist, defenders should prioritize inventory and access restrictions, though the authentication prerequisite keeps risk low for most environments.
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows a low-privileged user with valid credentials to reach the web administration interface and supply a crafted language-upload filename that is executed as shell commands, compromising confidentiality, integrity, and availability of the device. This is a genuine but conditional priority: publicly available exploit code exists, but successful exploitation requires network reachability to the management interface and valid low-privilege credentials. DrayTek has released firmware 1.5.1.7, which the vendor indicates corrects this issue and other security problems in the end-of-sale Vigor2960 line.
OS command injection in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 allows authenticated, low-privilege attackers to execute arbitrary shell commands on the device through the web management interface. The flaw resides in the CGI handler /cgi-bin/mainfunction.cgi (function sub_182B0), where the usefile, usescript, and option parameters are passed to a shell without adequate sanitization. Publicly available exploit code exists, and the vendor has classified the Vigor2960 as End-of-Service with only limited support, so legacy deployments exposing the management interface are the primary exposure.
Authenticated command injection in DrayTek Vigor2960 1.5.1.6 Revision 8218 lets a low-privileged user of the web management interface run arbitrary OS commands by manipulating the sectiontype argument to set_table in /cgi-bin/mainfunction.cgi. Publicly available exploit code exists, but the attack requires valid credentials and network reachability to the HTTP(S) management service. The vendor has placed the Vigor2960 on end-of-support with limited maintenance, so replacement or mitigation is more realistic than waiting for a dedicated fix.
Authenticated command injection in the IPsec certificate-handling path of DrayTek Vigor2960 routers running firmware 1.5.1.6 Revision 8218 lets a low-privilege management user execute arbitrary OS commands on the device, fully compromising confidentiality, integrity and availability. Publicly available exploit code exists and maps directly to the flaw (DRV2960-0014), though no active exploitation is confirmed by CISA KEV. DrayTek has discontinued the Vigor2960 (EoS with limited support) and states it only reviews major issues such as unauthenticated flaws, making the availability of the 1.5.1.7 fix and a prompt upgrade the primary defense.
Authenticated path traversal in the End-of-Sale DrayTek Vigor2960 1.5.1.6 web management interface lets a low-privilege user manipulate the multipart field name processed by cgiEscape in /cgi-bin/mainfunction.cgi, enabling path traversal and file clobbering. The vendor fixed the issue in firmware 1.5.1.7, but public exploit code exists for the affected swmconfigupload component; exploitation still requires valid credentials and reachability to the management interface. No CISA KEV confirmation or EPSS score was included, so this should be treated as a moderate-priority authenticated issue rather than confirmed active exploitation.
Path traversal in DrayTek Vigor2960 1.5.1.6 Revision 8218 allows an authenticated low-privilege user to manipulate the setSWMProfile argument in /cgi-bin/mainfunction.cgi and reach files outside the intended directory. Publicly available exploit code exists, and the vendor states that 2960 firmware 1.5.1.7 corrected many security issues while noting the Vigor2960 is End-of-Service with limited support. The CVSS 4.0 score is 5.3 with Low confidentiality, integrity, and availability impact; risk increases where the web management interface is reachable from untrusted networks.
Authenticated remote attackers can exploit an unrestricted file-upload flaw in DrayTek Vigor2960 firmware 1.5.1.6 Revision 8218 by manipulating the upload_path and upload_name parameters in the commonupload function of /cgi-bin/mainfunction.cgi, resulting in arbitrary file clobber on the device. Publicly available exploit code exists, but exploitation requires valid credentials and access to the web management interface, keeping the issue moderate-risk rather than an emergency. DrayTek addressed the flaw in firmware 1.5.1.7; because the Vigor2960 is end-of-sale with limited support, exposure is limited to units still running the vulnerable release.
Authenticated path traversal in DrayTek Vigor2960 firmware 1.5.1.6 (Revision 8218) lets a user with a valid web-management session manipulate the 'action' argument in the Apmupload component of /cgi-bin/mainfunction.cgi to traverse paths and potentially clobber targeted files, with low confidentiality, integrity, and availability impact. The issue is remotely reachable but requires authentication and network access to the management interface, and the vendor has fixed it in firmware 1.5.1.7; publicly available exploit code exists, while no CISA KEV active-exploitation confirmation was provided. Because the Vigor2960 is end-of-support and unpatched devices may persist, defenders should prioritize inventory and access restrictions, though the authentication prerequisite keeps risk low for most environments.