CVE-2026-113394: Path Traversal in DrayTek Vigor2960

This vulnerability involves a path traversal issue in the setSWMProfile function of the DrayTek Vigor2960 firmware version 1.5.1.6 Revision 8218. By manipulating the setSWMProfile argument, an attacker can traverse directories on the device remotely. The vendor notes that version 1.5.1.7 corrected many security issues but the product is EoS with limited support, focusing only on major unauthenticated vulnerabilities. Public exploit code exists, but no evidence of active exploitation in the wild is reported.

Successful exploitation allows remote attackers with low privileges to perform path traversal, potentially accessing or modifying files outside intended directories. This could lead to information disclosure or further compromise of the device. The CVSS 4.0 score is 5.3 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability.

The vendor fixed many security issues including this vulnerability in version 1.5.1.7. However, since the product is end-of-support with limited maintenance, users should upgrade to version 1.5.1.7 if possible. If upgrading is not feasible, consider isolating the device from untrusted networks to reduce exposure. Patch status is not fully confirmed due to limited support; check vendor advisories for any updates.