CVE-2026-113392

DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal

State: Published
Severity: 5.3 Medium
Published: Oct 20, 2026
Updated: Oct 20, 2026
Reserved: Oct 20, 2026

Description

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is able to resolve this issue. Upgrading the affected component is advised. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P	VulDB
3.1	7.4 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	7.4 High	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-22 Path Traversal

Affected Products

Product	Versions
Vigor2960DrayTek	1.5.1.6 Revision 8218Affected 1.5.1.7Not affected

References

VDB-422668 | DrayTek Vigor2960 Apmupload mainfunction.cgi path traversalvdb-entrytechnical-description
VDB-422668 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-113392 | CVE Analysis and Reportthird-party-advisory
Submit #992245 | DrayTek Vigor2960 Vigor2960 1.5.1.6 (revision 8218) uthenticated apmupload Path Traversal File Clobberthird-party-advisory
https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0009-authenticated-apmupload-path-traversal-clobberexploit
https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zippatch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.