CVSS: 8.5EPSS: 0%CPEs: 3EXPL: 1CVE-2023-6265 – DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
https://notcve.org/view.php?id=CVE-2023-6265
22 Nov 2023 — Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported. Draytek Vigor2960 v1.5.1.4 y v1.5.1.5 son vulnerables a directory traversal a través del parámetro 'option' mainfunction.cgi dumpSyslog que permite a un atacante autenticado con acceso a la interfaz de administración web eliminar archivos ... • https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2023-24229
https://notcve.org/view.php?id=CVE-2023-24229
15 Mar 2023 — DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. • https://github.com/sadwwcxz/Vul • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2023-1009 – DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal
https://notcve.org/view.php?id=CVE-2023-1009
24 Feb 2023 — A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. • https://github.com/xxy1126/Vuln/blob/main/Draytek/1.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •