CVE-2026-129450 | DrayTek Vigor2960 1.5.1.6 mainfunction.cgi?action=doWebBackup sub_1E084 option path traversal

A vulnerability, which was classified as very critical, was found in DrayTek Vigor2960 1.5.1.6. Affected by this issue is the function sub_1E084 of the file /cgi-bin/mainfunction.cgi?action=doWebBackup. The manipulation of the argument option results in path traversal.

This vulnerability is known as CVE-2026-129450. It is possible to launch the attack remotely. Furthermore, an exploit is available.

You should upgrade the affected component.

The vendor recommends: “1.5.1.6 isn’t the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.”VulDB Recent EntriesRead More