High severity · published Nov 22, 2023
CVE-2023-6265
DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
8.1
CVSS
1.8%
EPSS
No
On KEV
Description
** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Vigor2960 · DrayTek
1.5.1.4; 1.5.1.5 · source: vendor
VF
Vigor2960 Firmware · Draytek
1.5.1.4; 1.5.1.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6265
Exploit
https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md
Product
https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
Product
https://www.draytek.com/products/vigor2960/
More from Vigor2960
9.8
CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
9.8
CVE-2024-12986
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection