VIGOR2960 FIRMWARE · CVE-2026-129453 · Infrastructure
FIX → 1.5.1.7
DrayTek Vigor2960 firmware 1.5.1.6 (revision 8218) has a heap-based buffer overflow in check_file_exist in /cgi-bin/mainfunction.cgi, via the upload_name argument. It is remotely reachable through the web interface. The reporter's submission calls it authenticated, so login is needed. A public proof of concept exists and no in-the-wild exploitation is reported. VulDB lists 1.5.1.7 as the fix. DrayTek's quoted statement says 1.5.1.6 is not the latest and another release is planned. The Vigor2960 is end-of-support with limited fixes.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Anyone running a Vigor2960 on firmware 1.5.1.6 whose web admin interface is reachable, especially from the internet. The reporter describes it as authenticated, so an attacker needs a login, but the CVSS 9.9 score and the public PoC make exposed admin pages risky. Devices already on 1.5.1.7, or with the admin interface limited to a trusted LAN or VPN, are at much lower risk.
Not affected if admin-interface-not-exposed, firmware-1.5.1.7, no-remote-web-admin, other-firmware-version
Who cares authenticated, draytek, end-of-support, firmware, router, routers, vigor2960
1.5.1.6 is the affected versionUpgrade to 1.5.1.7
1.5.1.7 (fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/)s 1.5.1.7Improve Web CGI Security' and does not name this CVE, so treat it as likely but unconfirmedA vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
release note says onlyNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.