CVE-2023-6265

** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbitrary files. Vigor2960 is no longer supported.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cisa-cgCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
draytekvigor2960_firmware
1.5.1.4
draytekvigor2960_firmware
1.5.1.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md
https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
https://www.draytek.com/products/vigor2960/
https://github.com/xxy1126/Vuln/blob/main/Draytek/4.md
https://www.draytek.com/about/newsroom/2021/2021/end-of-life-notification-vigor2960
https://www.draytek.com/products/vigor2960/