CVE-2026-129451 | DrayTek Vigor2960 up to 1.5.1.6 mainfunction.cgi app_guest_export filename path traversal

A vulnerability has been found in DrayTek Vigor2960 up to 1.5.1.6 and classified as very critical. This affects the function app_guest_export of the file /cgi-bin/mainfunction.cgi. This manipulation of the argument filename causes path traversal.

This vulnerability is handled as CVE-2026-129451. The attack can be initiated remotely. Additionally, an exploit exists.

The affected component should be upgraded.

The vendor recommends: “1.5.1.6 isn’t the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.”VulDB Recent EntriesRead More