Threats affecting pkg:github/yikesoftware/DrayTek_Vigor2960_Security_Analysis

A critical heap-based buffer overflow vulnerability exists in the check_file_exist function of the /cgi-bin/mainfunction.cgi component in DrayTek Vigor2960 version 1.5.1.6. This vulnerability can be exploited remotely by manipulating the upload_name argument. Exploit code has been publicly disclosed. Upgrading to version 1.5.1.7 addresses this issue.

CVE-2026-129452 is a critical command injection vulnerability in DrayTek Vigor2960 version 1.5.1.6. It affects the set_table function in /cgi-bin/mainfunction.cgi, allowing remote attackers to execute arbitrary commands by manipulating the jsondata argument. The vulnerability has been publicly disclosed and exploit code may exist. Upgrading to version 1.5.1.7 resolves the issue.