Back to Database
Status published
Medium
CVE-2023-6265
DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal
Vulnerability Description
** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6265
Credits & Attribution
No credits recorded in the NVD database.
References
More from DrayTek
View All →CVE-2024-12987
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
Medium
6.9
CVE-2024-12986
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
Medium
6.9
CVE-2023-1163
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal
Medium
6.5
CVE-2023-1162
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection
High
7.2
CVE-2023-1009
DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversal
Medium
6.5
Affected Vendor
DrayTek
View all reports →Affected Software
Vigor2960
Vulnerable Versions:
1.5.1.4, 1.5.1.5
Timeline
Official Publish:
November 22nd, 2023
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H