CVE-2026-113394 | DrayTek Vigor2960 1.5.1.6 Revision 8218 mainfunction.cgi setSWMProfile path traversal

October 20, 2026 Yanac

A vulnerability identified as critical has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is traded as CVE-2026-113394. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

The vendor explains: “2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)”.VulDB Recent EntriesRead More