CVE-2023-6265CWE-22

DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

Medium · published November 22, 2023

CVSS v3.1
6.5
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01800 · 78.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-11-22T19:47Z
EPSS history
Timeline
  • 22 NOV 19:47Z
    DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
    cvelistv5