CVE-2026-129451
Deferred Deferred - Pending Action

Path Traversal in DrayTek Vigor2960 Firmware

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulDB

Description
A flaw has been found in DrayTek Vigor2960 up to 1.5.1.6. This affects the function app_guest_export of the file /cgi-bin/mainfunction.cgi. This manipulation of the argument filename causes path traversal. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 1.5.1.7 is able to mitigate this issue. The affected component should be upgraded. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129451
EUVD
EUVD-2026-126017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
draytek vigor2960 to 1.5.1.6 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-129451 is a path traversal vulnerability in DrayTek Vigor2960 routers running firmware version 1.5.1.6. It exists in the app_guest_export function of the /cgi-bin/mainfunction.cgi file. The flaw allows authenticated attackers to manipulate the filename parameter to access or modify files outside the intended directory by using path traversal sequences like ../../../../. The CGI handler runs as root, increasing the potential impact.

Detection Guidance

Check if your DrayTek Vigor2960 router is running firmware version 1.5.1.6 or earlier. Inspect network traffic for POST requests to /cgi-bin/mainfunction.cgi with action=app_guest_export and a filename containing path traversal sequences like ../../../../. Monitor for unexpected file writes, reads, or deletions in system directories.

Impact Analysis

This vulnerability allows attackers to read, write, or delete arbitrary files on the system. Since the CGI handler runs as root, attackers could overwrite critical system files, delete important data, or execute unauthorized actions. Exploitation requires authentication but could lead to full system compromise if credentials are obtained.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, or data integrity issues, requiring organizations to assess and potentially report incidents under these regulations.

Mitigation Strategies

Upgrade the DrayTek Vigor2960 firmware to version 1.5.1.7 or later immediately. Restrict file export operations to a fixed, validated directory. Validate all user-controlled filenames to prevent path traversal sequences. Limit file deletion operations to files created during the current request.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129451. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...