# CVE-2026-113394: DrayTek Vigor2960 path traversal and command injection in setSWMProfile

Source: https://junglewise.ai/threats/cve-2026-113394-a-vulnerability-was-identified-in-draytek-vigor2960-1-5-1-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-20. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-113394 · Severity: high · CVSS 7.4 · Published 2026-10-20

DrayTek Vigor2960 is a network router used to manage enterprise connectivity. An authenticated administrator can exploit a path traversal vulnerability in the setSWMProfile function to write arbitrary files to the device filesystem or execute arbitrary commands as root. This allows an attacker with valid admin credentials to compromise router functionality and gain full system control.

Technologies: [DrayTek Vigor2960](https://junglewise.ai/threats/technologies/vigor2960). Vendors: [DrayTek](https://junglewise.ai/threats/vendors/draytek).

## Quick answers

**Is CVE-2026-113394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-113394 being exploited in the wild.

**How severe is CVE-2026-113394?** High severity, with a CVSS score of 7.4, published 20 October 2026.

**Which products and versions are affected?** DrayTek Vigor2960 1.5.1.6 Revision 8218.

**Is there a fix for CVE-2026-113394?** Yes: fixed in Vigor2960 1.5.1.7. Until then: Restrict administrative access to the Vigor2960 management interface to trusted networks only, and disable remote administration if not required. However, the vendor states this product is end-of-support and upgrade to version 1.5.1.7 or a current model is strongly recommended. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-113394 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-113394?** Check whether you run DrayTek Vigor2960 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Vigor2960 1.5.1.7

Restrict administrative access to the Vigor2960 management interface to trusted networks only, and disable remote administration if not required. However, the vendor states this product is end-of-support and upgrade to version 1.5.1.7 or a current model is strongly recommended.

## Technical details

The setSWMProfile function in /cgi-bin/mainfunction.cgi concatenates an attacker-controlled filename parameter directly to the fixed path /data/swm/ without filtering path traversal sequences (../) or normalizing the result, allowing arbitrary file writes. Additionally, the same filename is passed unsanitized into shell commands executed via system(), enabling command injection through single-quote escape. The vulnerability requires an authenticated administrator session and affects Vigor2960 1.5.1.6 Revision 8218, which is end-of-support.

## Affected products

- DrayTek Vigor2960 1.5.1.6 Revision 8218

## Timeline

- 2026-10-20: disclosed
- other: Exploit code publicly available

## References

- [https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0011-authenticated-swmprofile-path-traversal-clobber](https://github.com/yikesoftware/DrayTek_Vigor2960_Security_Analysis/tree/main/cases/DRV2960-0011-authenticated-swmprofile-path-traversal-clobber)
- [https://vuldb.com/cve/CVE-2026-113394](https://vuldb.com/cve/CVE-2026-113394)

## Related threats

- [DrayTek Vigor2960 command injection in IPsec handler](https://junglewise.ai/threats/cve-2026-113397-a-security-vulnerability-has-been-detected-in-draytek-vigor2960)
- [DrayTek Vigor2960 command injection in rename table handler](https://junglewise.ai/threats/cve-2026-113396-a-weakness-has-been-identified-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 path traversal in swmconfigupload](https://junglewise.ai/threats/cve-2026-113395-a-security-flaw-has-been-discovered-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 arbitrary file write in commonupload](https://junglewise.ai/threats/cve-2026-113393-a-vulnerability-was-determined-in-draytek-vigor2960-1-5-1-6)
- [DrayTek Vigor2960 path traversal in apmupload](https://junglewise.ai/threats/cve-2026-113392-a-vulnerability-was-found-in-draytek-vigor2960-1-5-1-6-revision)