CVE-2026-129453
Deferred Deferred - Pending Action

Heap-based Buffer Overflow in DrayTek Vigor2960

Publication date: 2026-11-15

Last updated on: 2026-11-15

Assigner: VulDB

Description
A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-15
Last Modified
2026-11-15
Generated
2026-11-15
AI Q&A
2026-11-15
EPSS Evaluated
N/A
NVD
CVE-2026-129453
EUVD
EUVD-2026-126031

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
draytek vigor2960 to 1.5.1.7 (exc)
draytek vigor2960 1.5.1.7
draytek vigor2960 1.5.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a heap-based buffer overflow in DrayTek Vigor2960 version 1.5.1.6. It occurs in the check_file_exist function of the /cgi-bin/mainfunction.cgi component. The issue is triggered by manipulating the upload_name argument, which allows an attacker to overflow a heap buffer when the value exceeds the allocated size. The attack can be performed remotely and has been publicly disclosed.

Detection Guidance

To detect this vulnerability, monitor for crashes in the mainfunction.cgi process on DrayTek Vigor2960 devices. Check logs for segmentation faults (SIGSEGV) in CGI processes. Use network traffic analysis to identify POST requests to /cgi-bin/mainfunction.cgi with action=check_file_exist and large upload_name parameters (e.g., 256 bytes).

Commands: Check system logs for 'segfault' or 'mainfunction.cgi' errors. Use tcpdump or Wireshark to inspect HTTP POST requests to the CGI endpoint. Verify device firmware version is below 1.5.1.7.

Impact Analysis

An attacker could exploit this to crash the affected CGI process, causing a denial of service. Since the vulnerability requires authentication, it primarily impacts administrators. However, successful exploitation may lead to system instability or potential further compromise if combined with other vulnerabilities.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling remote attackers to execute arbitrary code or cause denial-of-service conditions on affected DrayTek Vigor2960 devices. Exploitation may lead to unauthorized access, data breaches, or disruption of critical network services, which are key concerns under these regulations.

Mitigation Strategies

Immediately upgrade the DrayTek Vigor2960 firmware to version 1.5.1.7 or later. Ensure all administrative sessions are terminated after patching. Monitor network traffic for suspicious POST requests to /cgi-bin/mainfunction.cgi.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-129453. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...