PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113395 DrayTek CVE debrief

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218, specifically in the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload, allowing for path traversal attacks. The exploit has been released publicly and can be used for attacks. Upgrading to version 1.5.1.7 is sufficient to fix this issue. However, the affected component is no longer supported by the maintainer, with only major issues being reviewed.

Vendor
DrayTek
Product
Vigor2960
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-20
Advisory published
2026-10-20
Advisory updated
2026-10-20

Who should care

Defenders responsible for DrayTek Vigor2960 devices, specifically those using version 1.5.1.6 Revision 8218, should be aware of this vulnerability and take action to mitigate the risk of path traversal attacks.

Why it matters

CVE-2026-113395 is a path traversal vulnerability in DrayTek Vigor2960 devices that allows for unauthorized access to sensitive files or data. Defenders should prioritize upgrading to version 1.5.1.7 or applying compensating controls to mitigate the risk.

  • Path traversal attacks may lead to unauthorized access to sensitive files or data.
  • The public availability of the exploit increases the risk of attacks.
  • Limited support for the affected component may delay or limit remediation efforts.
  • Defenders should verify the vulnerability and apply patches or compensating controls.

Technical summary

The vulnerability is caused by the cgiEscape function in the /cgi-bin/mainfunction.cgi file of the swmconfigupload component, which allows for path traversal attacks. The exploit has been publicly released, and defenders should prioritize upgrading to version 1.5.1.7 or applying compensating controls. The affected product, DrayTek Vigor2960 version 1.5.1.6 Revision 8218, is no longer supported by the maintainer, which may impact remediation efforts. Defenders should verify the vulnerability and apply patches or compensating controls to mitigate the risk of path traversal attacks.

Defensive priority

Defenders should prioritize upgrading to version 1.5.1.7 or applying compensating controls to mitigate the risk of path traversal attacks.

Recommended defensive actions

  • Upgrade to version 1.5.1.7
  • Apply compensating controls to mitigate path traversal attacks
  • Monitor for suspicious activity related to the swmconfigupload component
  • Review and verify the vulnerability in managed environments
  • Track exceptions and retest remediated assets
  • Check relevant monitoring, detection, and logs for exposed assets
  • Plan vendor-supported updates or mitigations through normal change control

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and available patches. However, the limited support for the affected component and the public availability of the exploit increase the urgency for defenders to take action.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113395 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113395

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113395 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113395

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113395.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422671

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422671/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-113395

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/992248

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0012-authenticated-swmconfigupload-fieldname-path-traversal-clobber

    Supplemental source - exploit

  • Source reference

    Unverified legacy reference

    URL: https://fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/Vigor2960_v1.5.1.7.zip

    Supplemental source - patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.