by Kastro CVE-2026-129449
DrayTek Vigor2960 — DrayTek Vigor2960 mainfunction.cgi sub_14914 command injection
Description · from the CVE record
A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 addresses this issue. It is advisable to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Affected
ProductAffectedFixed inSource
Vigor29601.5.1.01.5.1.7CNA
Vigor29601.5.1.11.5.1.7CNA
Vigor29601.5.1.21.5.1.7CNA
Vigor29601.5.1.31.5.1.7CNA
Vigor29601.5.1.41.5.1.7CNA
Vigor29601.5.1.51.5.1.7CNA
Vigor29601.5.1.61.5.1.7CNA
Scores by source
VulDB (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
VulDB (CNA)9.9CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
VulDB (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P