Skip to content
Fencer Vulns
medium 6.5

CVE-2023-6265 json

DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

published 2023-11-22 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-58510

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.

Exploit prediction

1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

  • DrayTek Vigor2960

Classification

Weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.