CVE-2026-129449 · Infrastructure
NO FIX YET · SEE WHAT TO DO
DrayTek Vigor2960 routers up to firmware 1.5.1.6 let a remote attacker inject commands through the swmconfigupload argument of /cgi-bin/mainfunction.cgi. The exploit has been disclosed publicly.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running DrayTek Vigor2960 routers on firmware up to 1.5.1.6 are exposed, especially if the web management interface is reachable from the internet. Sites with the interface restricted to a trusted internal network have lower exposure. Anyone not running a Vigor2960 can skip it.
Not affected if firmware-newer-than-1.5.1.6, other-models
Who cares draytek, network-edge, routers, vigor2960
1.5.1.61.5.1.7, per the NVD description; the vendor says a further release is plannedA security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.6. Affected by this vulnerability is the function sub_14914 of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument swmconfigupload leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.5.1.7 addresses this issue. It is advisable to upgrade the affected component. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.