[0day-rubbish] DrayTek Vigor 2960 v1.5.1.6 Authenticated command injection to root RCE in uploadlangs (8.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-04 00:11 UTC
Importiert: 2026-09-04 00:48 UTC
Quelle-ID: full_disc
uid_hash: 6b81d684e4f2e220806c2a514689a76359aa8fea1811c3e30f39d3940f59f941

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in DrayTek Vigor 2960 v1.5.1.6.

Type: Authenticated command injection to root RCE in uploadlangs (CWE-78)

CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Impact: Root command execution on the SMB edge gateway: VPN keys, firewall rules, routing state, VoIP services, and

proxied traffic under attacker control.

Authentication: authenticated (requires valid session)

Full...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss