Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-113394: DrayTek Vigor2960 allows remote file access
CVE-2026-113394 · published 15 days ago
Summary
The router's web interface can be tricked into reading any file on the device by using a specially crafted request. This can be done over the network without authentication, and tools to exploit it are already publicly available. Upgrade to the latest firmware or replace the router, as the current model is no longer supported.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| draytek | vigor2960 | 1.5.1.6 Revision 8218 |
Original advisory text
DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal
A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published20 Oct 2026
Updated4 Nov 2026
First seen20 Oct 2026
Track software like this
Free during beta