CVE-2026-129450
Deferred Deferred - Pending Action

Path Traversal in DrayTek Vigor2960 Firmware

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulDB

Description
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub_1E084 of the file /cgi-bin/mainfunction.cgi?action=doWebBackup. The manipulation of the argument option results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. Upgrading to version 1.5.1.7 can resolve this issue. You should upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129450
EUVD
EUVD-2026-126014

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
draytek vigor2960 to 1.5.1.7 (exc)
draytek vigor2960 1.5.1.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129450 is a path traversal and command injection flaw in DrayTek Vigor2960 router firmware version 1.5.1.6. It affects the doWebBackup function in mainfunction.cgi. An attacker with admin access can manipulate the 'option' parameter to traverse outside the /tmp directory and execute arbitrary root-level commands by injecting shell commands into the tar command used for backups.

Detection Guidance

Check if your DrayTek Vigor2960 router is running firmware version 1.5.1.6. Inspect network traffic for POST requests to /cgi-bin/mainfunction.cgi?action=doWebBackup with manipulated 'option' parameters containing '../' sequences. Monitor for unexpected file writes or deletions in system directories.

Impact Analysis

This vulnerability allows attackers to read, write, or delete arbitrary files on the system, execute root-level commands, and potentially gain full control over the affected router. It can lead to data theft, system compromise, or disruption of network services.

Compliance Impact

This vulnerability allows authenticated attackers to execute arbitrary root-level commands, read, write, or delete sensitive files, and gain full system access. Such capabilities could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade the DrayTek Vigor2960 firmware to version 1.5.1.7 or later immediately. Disable administrative access to the router from untrusted networks. Implement strict input validation for the 'option' parameter in the doWebBackup function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129450. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...