{"id":"CVE-2026-129453","kind":"vulnerability","aliases":["CVE-2026-129453"],"related":[],"title":"DrayTek Vigor2960 1.5.1.6: heap overflow in check_file_exist (authenticated per reporter); public PoC","description":"A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: \"1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported.\"","summary":"DrayTek Vigor2960 firmware 1.5.1.6 (revision 8218) has a heap-based buffer overflow in check_file_exist in /cgi-bin/mainfunction.cgi, via the upload_name argument. It is remotely reachable through the web interface. The reporter's submission calls it authenticated, so login is needed. A public proof of concept exists and no in-the-wild exploitation is reported. VulDB lists 1.5.1.7 as the fix. DrayTek's quoted statement says 1.5.1.6 is not the latest and another release is planned. The Vigor2960 is end-of-support with limited fixes.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Vigor2960 firmware","fixed":["1.5.1.7"],"affected":"1.5.1.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","draytek","end-of-support","firmware","infrastructure","router","routers","vigor2960"],"not_affected_if":["admin-interface-not-exposed","firmware-1.5.1.7","no-remote-web-admin","other-firmware-version"],"how_to_check":"Check the firmware version in the router's web admin (System Maintenance > Firmware Information). 1.5.1.6 is the affected version. Also check whether the web admin (HTTP/HTTPS) is reachable from the WAN or an untrusted network.","fix":"Upgrade to Vigor2960 firmware 1.5.1.7 (fw.draytek.com.tw/Vigor2960/Firmware/v1.5.1.7/). This comes from VulDB; DrayTek's 1.5.1.7 release note says only 'Improve Web CGI Security' and does not name this CVE, so treat it as likely but unconfirmed. Restrict web admin access to trusted networks meanwhile.","status":"open","published_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","triaged_at":"2026-11-15T14:37:17+00:00","updated_at":"2026-11-15T14:38:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-15T14:37:17Z","model":"claude-haiku-5-5","output":{"fix":"- DrayTek Vigor2960: upgrade to `1.5.1.7`, per the NVD description.\n- The vendor says a newer 2960 release fixes more security issues and recommends upgrading beyond `1.5.1.6`.","reach":"internet","title":"DrayTek Vigor2960 router: heap overflow in file check lets remote attackers run code","impact":"high","summary":"DrayTek Vigor2960 firmware 1.5.1.6 has a heap-based buffer overflow in the check_file_exist function of /cgi-bin/mainfunction.cgi, triggered by a manipulated upload_name argument. A remote attacker can send a crafted request to corrupt memory on the router, and a public exploit is reported to exist.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["draytek","vigor2960","routers","firmware"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker runs code on the router","analyst_note":"Confirm whether the upload_name overflow requires authentication and whether the 1.5.1.7 fix is the vendor's official release; check DrayTek's security advisory.","how_to_check":"- Check the firmware version on the router's admin page; `1.5.1.6` is the affected version.\n- Confirm whether the web administration interface is reachable from the internet.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-version","no-remote-web-admin"],"who_is_affected":"Organizations running DrayTek Vigor2960 routers on firmware 1.5.1.6, particularly with the web management interface exposed to the internet. Devices on other firmware versions or without remote web access are less exposed, but the sources do not confirm which other versions are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000796,"input_tokens":4672,"output_tokens":657,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm whether the upload_name overflow requires authentication and whether the 1.5.1.7 fix is the vendor's official release; check DrayTek's security advisory.","search":"'-129453':17A,20A '-2026':16A,19A '/cgi-bin/mainfunction.cgi':52B,142C '1.5.1.6':3A,37B,103B,130C,199C '1.5.1.7':94B,183C '2960':206C '8218':39B 'address':187C 'affect':133C,192C 'anoth':109B,217C 'argument':57B,154C 'attack':165C 'authent':10A,23B,72B 'base':44B,161C 'buffer':45B,162C 'call':70B 'capabl':185C 'check':7A,48B,136C,148C 'compon':145C,193C 'concept':81B 'could':177C 'cve':15A,18A 'draytek':1A,24B,34B,98B,128C 'end':26B,117B 'end-of-support':25B,116B 'exist':9A,50B,82B,138C,147C 'exploit':89B,171C 'file':8A,49B,137C,141C,146C 'firmwar':29B,36B 'firmware':22A 'fix':97B,122B,210C 'found':126C 'function':135C 'heap':4A,43B,160C 'heap-bas':42B,159C 'in-the-wild':85B 'infrastructur':30B 'initi':168C 'interfac':65B 'isn':200C 'issu':132C,189C,213C,227C 'latest':107B,203C,208C 'limit':121B 'list':93B 'login':74B 'made':174C 'mani':211C 'manipul':151C 'may':166C 'name':56B,156C 'need':76B 'one':218C 'overflow':5A,46B,163C 'per':11A 'perform':149C 'plan':112B,222C 'poc':14A 'proof':79B 'public':13A,78B,175C 'quot':100B 'reachabl':61B 'recommend':195C,198C 'releas':110B,221C 'remot':60B,169C 'report':12A,67B,91B,228C 'result':157C 'revis':38B 'router':31B,32B 'say':102B 'secur':212C 'solv':225C 'statement':101B 'submiss':69B 'support':28B,119B 'upgrad':180C,190C 'upload':55B,155C 'use':179C 'vendor':197C 'version':182C,204C,209C 'via':53B 'vigor2960':2A,21A,33B,35B,114B,129C 'vuldb':92B 'vulner':124C 'web':64B 'wild':88B","nicknames":[],"mitigations":[],"who_affected":"Anyone running a Vigor2960 on firmware 1.5.1.6 whose web admin interface is reachable, especially from the internet. The reporter describes it as authenticated, so an attacker needs a login, but the CVSS 9.9 score and the public PoC make exposed admin pages risky. Devices already on 1.5.1.7, or with the admin interface limited to a trusted LAN or VPN, are at much lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["firmware","vigor2960firmware"],"ptokens":["firmware","vigor2960"],"labels":["authenticated","critical","draytek","endofsupport","firmware","infrastructure","router","routers","vigor2960"],"campaign_type":null,"search_a":"'-129453':17A,20A '-2026':16A,19A '1.5.1.6':3A 'authent':10A 'check':7A 'cve':15A,18A 'draytek':1A 'exist':9A 'file':8A 'firmware':22A 'heap':4A 'overflow':5A 'per':11A 'poc':14A 'public':13A 'report':12A 'vigor2960':2A,21A","search_b":"'/cgi-bin/mainfunction.cgi':52B '1.5.1.6':37B,103B '1.5.1.7':94B '8218':39B 'anoth':109B 'argument':57B 'authent':23B,72B 'base':44B 'buffer':45B 'call':70B 'check':48B 'concept':81B 'draytek':24B,34B,98B 'end':26B,117B 'end-of-support':25B,116B 'exist':50B,82B 'exploit':89B 'file':49B 'firmwar':29B,36B 'fix':97B,122B 'heap':43B 'heap-bas':42B 'in-the-wild':85B 'infrastructur':30B 'interfac':65B 'latest':107B 'limit':121B 'list':93B 'login':74B 'name':56B 'need':76B 'overflow':46B 'plan':112B 'proof':79B 'public':78B 'quot':100B 'reachabl':61B 'releas':110B 'remot':60B 'report':67B,91B 'revis':38B 'router':31B,32B 'say':102B 'statement':101B 'submiss':69B 'support':28B,119B 'upload':55B 'via':53B 'vigor2960':33B,35B,114B 'vuldb':92B 'web':64B 'wild':88B","search_c":"'/cgi-bin/mainfunction.cgi':142C '1.5.1.6':130C,199C '1.5.1.7':183C '2960':206C 'address':187C 'affect':133C,192C 'anoth':217C 'argument':154C 'attack':165C 'base':161C 'buffer':162C 'capabl':185C 'check':136C,148C 'compon':145C,193C 'could':177C 'draytek':128C 'exist':138C,147C 'exploit':171C 'file':137C,141C,146C 'fix':210C 'found':126C 'function':135C 'heap':160C 'heap-bas':159C 'initi':168C 'isn':200C 'issu':132C,189C,213C,227C 'latest':203C,208C 'made':174C 'mani':211C 'manipul':151C 'may':166C 'name':156C 'one':218C 'overflow':163C 'perform':149C 'plan':222C 'public':175C 'recommend':195C,198C 'releas':221C 'remot':169C 'report':228C 'result':157C 'secur':212C 'solv':225C 'upgrad':180C,190C 'upload':155C 'use':179C 'vendor':197C 'version':182C,204C,209C 'vigor2960':129C 'vulner':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129453","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129453","severity":null,"published_at":"2026-11-15T14:17:26+00:00","modified_at":"2026-11-15T14:17:26+00:00","first_seen_at":"2026-11-15T14:36:15+00:00","fetched_at":"2026-11-15T14:36:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129453:4041","url":"https://vuldb.com/vuln/437464","severity":null,"published_at":"2026-11-15T14:38:17+00:00","modified_at":"2026-11-15T14:38:17+00:00","first_seen_at":"2026-11-15T14:38:17+00:00","fetched_at":"2026-11-15T14:38:17+00:00","note":"VulDB (CNA) entry says fix is 1.5.1.7 and the submission title says Authenticated; DrayTek's own advisory page does not list it, and the 1.5.1.7 release note only says 'Improve Web CGI Security' with no CVE. Nothing verified. Exa search worked; X not checked.","cites":["https://vuldb.com/vuln/437464","https://www.draytek.nl/storage/DrayTek_Vigor2960_V1.5.1.7_release-note.pdf"]}],"documents":[{"id":163834,"url":"https://vuldb.com/vuln/437464","title":"VulDB VDB-437464 CVE-2026-129453","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":163835,"url":"https://www.draytek.nl/storage/DrayTek_Vigor2960_V1.5.1.7_release-note.pdf","title":"DrayTek Vigor2960 1.5.1.7 release note","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}