CVE-2023-1009

🗓️ 24 Feb 2023 10:31:15Reported by VulDBType

cve🔗 web.nvd.nist.gov👁 37 Views🌐 WEB

Critical vulnerability in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 allows remote path traversal via /cgi-bin/mainfunction.cgi

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-1009	24 Feb 202314:49	–	circl
CNNVD	DrayTek Vigor2960 路径遍历漏洞	24 Feb 202300:00	–	cnnvd
Cvelist	CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal	24 Feb 202310:31	–	cvelist
EUVD	EUVD-2023-23301	3 Oct 202520:07	–	euvd
NVD	CVE-2023-1009	24 Feb 202311:15	–	nvd
OSV	CVE-2023-1009	24 Feb 202311:15	–	osv
Prion	Path traversal	24 Feb 202311:15	–	prion
Positive Technologies	PT-2023-9804 · Draytek · Draytek Vigor2960	24 Feb 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-1009	23 May 202502:33	–	redhatcve
Vulnrichment	CVE-2023-1009 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal	24 Feb 202310:31	–	vulnrichment

NVD

Vulners

Node

draytek vigor2960_firmwareMatch1.5.1.4

AND

draytek vigor2960Match-

[
  {
    "vendor": "DrayTek",
    "product": "Vigor 2960",
    "versions": [
      {
        "version": "1.5.1.4",
        "status": "affected"
      },
      {
        "version": "1.5.1.5",
        "status": "affected"
      }
    ],
    "modules": [
      "Web Management Interface"
    ]
  }
]

Source	Link
vuldb	www.vuldb.com/
vuldb	www.vuldb.com/
github	www.github.com/xxy1126/Vuln/blob/main/Draytek/1.md

Parameter	Position	Path	Description	CWE
option	query param	cgi-bin/mainfunction.cgi	Path traversal via the option parameter allowing access to /../etc/passwd- on vulnerable DrayTek Vigor 2960.	CWE-22

21 Nov 2024 07:38Current

5.7Medium risk

Vulners AI Score5.7

CVSS 3.15.5 - 6.5

CVSS 24

CVSS 36.5

EPSS0.03453

SSVC

CWE-22