CVE-2023-1009

Deeper analysis

CVE-2023-1009 is a path traversal vulnerability, tracked as CWE-22, that affects the web management interface of the DrayTek Vigor 2960 router running firmware versions 1.5.1.4 and 1.5.1.5. The flaw resides in the sub_1DF14 function within /cgi-bin/mainfunction.cgi, where the "option" argument can be supplied with a traversal sequence such as "/../etc/passwd" to access files outside the intended directory. The issue was reported against an unsupported product line and carries a CVSS 3.1 score of 6.5.

An authenticated remote attacker with low privileges can send a crafted HTTP request to the web interface and retrieve sensitive files from the device, resulting in disclosure of confidential information such as system credentials. No user interaction is required, and a public exploit has been made available.

The listed references consist of a proof-of-concept disclosure and Vuldb entries; they contain no vendor advisory or patch information because the affected firmware is explicitly unsupported. The EPSS score rose from a low baseline to a peak of 0.0576 before receding to its current value of 0.0345, indicating a period of increased exploitation interest after disclosure.