Path Traversal Vulnerability in DrayTek Vigor2960 Router
CVE-2026-129451

9.4CRITICAL

Key Information:

Vendor

Draytek
Status
Vigor2960
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-129451?

A path traversal vulnerability exists in the DrayTek Vigor2960 router versions up to 1.5.1.6, specifically within the app_guest_export function of the mainfunction.cgi script. By manipulating input parameters, an attacker can gain unauthorized access to files on the server, which may result in potential data exposure. This issue can be exploited remotely, allowing attackers to perform malicious actions without physical access. It is crucial for users to upgrade to version 1.5.1.7 to mitigate this vulnerability, as the vendor reports that the latest updates address this and other security concerns.

Affected Version(s)

Vigor2960 1.5.1.0

Vigor2960 1.5.1.1

Vigor2960 1.5.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-129451 - Proof of Concept

References

https://vuldb.com/vuln/437462
vdb-entrytechnical-description
https://vuldb.com/vuln/437462/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-129451
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

eqqie (VulDB User)
VulDB CNA Team
.