CVE-2023-1163 DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal
Remote attackers can exploit a path traversal flaw in the web management interface to read arbitrary files from the device.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1163?
CVE-2023-1163 is a medium-severity path traversal vulnerability in DrayTek Vigor 2960, published on 3 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5 and classified as critical. Affected by this vulnerability is the function getSyslogFile of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222259. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Weakness: CWE-22
Which versions are affected by CVE-2023-1163?
It affects 1 product.
Products include Draytek Vigor 2960 Firmware.
How do I fix CVE-2023-1163?
No fix has been published for CVE-2023-1163 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-1163 being exploited?
There is no known exploitation of CVE-2023-1163 in the wild and no public exploit code.
Other vulnerabilities in DrayTek Vigor 2960
Sources
Also known as GHSA-f5vh-pgc9-ww94.