CVE-2023-1009
Path Traversal in Draytek Vigor2960 Firmware 1.5.1.4
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-1009 is a medium-severity Path Traversal (CWE-22) vulnerability in Draytek Vigor2960 Firmware. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-1009 is a path traversal vulnerability, tracked as CWE-22, that affects the web management interface of the DrayTek Vigor 2960 router running firmware versions 1.5.1.4 and 1.5.1.5. The flaw resides in the sub_1DF14 function within /cgi-bin/mainfunction.cgi, where the "option" argument can be supplied with a traversal sequence such as "/../etc/passwd" to access files outside the intended directory. The issue was reported against an unsupported product line and carries a CVSS 3.1 score of 6.5.
An authenticated remote attacker with low privileges can send a crafted HTTP request to the web interface and retrieve sensitive files from the device, resulting in disclosure of confidential information such as system credentials. No user interaction is required, and a public exploit has been made available.
The listed references consist of a proof-of-concept disclosure and Vuldb entries; they contain no vendor advisory or patch information because the affected firmware is explicitly unsupported. The EPSS score rose from a low baseline to a peak of 0.0576 before receding to its current value of 0.0345, indicating a period of increased exploitation interest after disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-23301
Vulnerability Data
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with…
more
the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V5.3.2
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Patching/maintenance can remediate known path-traversal flaws in deployed software (partial prevention of exploitability) but does nothing to stop the coding defect from being introduced in the first place.
PR.AA-05 defines and reviews access policies but does not address code-level pathname neutralization, so neither direction prevents CWE-22.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.