Skip to content
Heist/ feed
High

DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal

Type: advisorySource: Official CVE List1 source record

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Announced Source revision 1
Original source ↗

CVE-2026-113394

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-113394

Vigor2960

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "cpes": [
      "cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*"
    ],
    "vendor": "DrayTek",
    "product": "Vigor2960",
    "versions": [
      {
        "status": "affected",
        "version": "1.5.1.6 Revision 8218"
      }
    ]
  }
]
Related CVEs
CVE-2026-113394

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#52450 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement