CVE-2026-113392
Deferred Deferred - Pending Action

Path Traversal in DrayTek Vigor2960 Firmware

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulDB

Description
A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-10
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-113392
EUVD
EUVD-2026-104984

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
DrayTek Vigor2960 1.5.1.6 Revision 8218

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113392 is a path traversal vulnerability in DrayTek Vigor2960 firmware version 1.5.1.6. It exists in the apmupload function of the /cgi-bin/mainfunction.cgi component. An attacker can manipulate the action argument to perform path traversal, allowing them to write arbitrary files to any location on the system using sequences like ../../../. The attack requires authenticated access but runs with root privileges.

Detection Guidance

Detecting this vulnerability requires checking the firmware version of your DrayTek Vigor2960 router. If the version is 1.5.1.6 (revision 8218), it is vulnerable. Logs may show unauthorized file writes or path traversal attempts in /cgi-bin/mainfunction.cgi.

Impact Analysis

This vulnerability allows authenticated attackers to overwrite critical system files, potentially leading to denial of service, unauthorized code execution, or complete system compromise. Since the exploit runs with root privileges, attackers could gain full control over the device. The public availability of a proof-of-concept increases the risk of exploitation.

Compliance Impact

This vulnerability allows authenticated attackers to write arbitrary files to any location on the system via path traversal. This could lead to unauthorized access to sensitive data, modification of critical system files, or installation of malicious software. For GDPR, this could result in unauthorized data access or processing, violating principles of data protection and user consent. For HIPAA, it may expose protected health information to unauthorized parties, compromising confidentiality and integrity requirements.

Mitigation Strategies

Upgrade the firmware to version 1.5.1.7 or later immediately. Since the product is end-of-life, consider replacing it with a supported alternative. Ensure administrative access is restricted to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113392. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...