Command Injection in DrayTek Vigor2960

Executive Summary

CVE-2026-129449 is a command injection vulnerability in DrayTek Vigor2960 routers running firmware version 1.5.1.6 or earlier. The flaw exists in the swmconfigupload function of the web interface, where an authenticated administrator can manipulate the multipart field name during a file upload to execute arbitrary shell commands. The issue arises because the field name is directly inserted into a shell command without proper escaping, allowing attackers to terminate the quoted context and append malicious commands.

The vulnerability requires valid administrator credentials and the attacker's host must be reachable by the device. Exploitation can lead to full command execution with the privileges of the mainfunction.cgi process, potentially enabling an interactive reverse shell on the device.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your DrayTek Vigor2960 router is running firmware version 1.5.1.6 or earlier. Inspect network traffic for POST requests to /cgi-bin/mainfunction.cgi/swmconfigupload with manipulated multipart field names. Monitor for unexpected command execution or reverse shell activity on the device.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with administrative access to execute arbitrary commands on the router, potentially leading to full system compromise. An attacker could take control of the device, steal sensitive data, or use it as a pivot point to attack other systems on the network. The ability to establish a reverse shell means the attacker could maintain persistent access even after the initial breach.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguards for protected health information. A successful exploit could result in data breaches, triggering mandatory breach notifications and potential fines under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade the DrayTek Vigor2960 firmware to version 1.5.1.7 or later. Ensure strong authentication for administrator access. Validate multipart field names in file uploads and avoid direct insertion into shell commands. Disable unnecessary services and restrict network access to the router's web interface.

Useful 0 Not Useful 0