DrayTek
Not on CISA's list of exploited flaws, and not in the news we track.
CVE-2026-129453High8.6
Reading the vendor advisory
Black Shard's team can check your exposure to CVE-2026-129453 and take the fix off your plate.
A vulnerability was found in DrayTek Vigor2960 1.5.1.6. This issue affects the function check_file_exist of the file /cgi-bin/mainfunction.cgi of the component File Existence Check. Performing a manipulation of the argument upload_name results in heap-based buffer overflow. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 1.5.1.7 is capable of addressing this issue. Upgrading the affected component is recommended. The vendor recommends: "1.5.1.6 isn't the latest version of 2960, the latest version fixes many security issues. And we have another one in our release plan which should solve the issues reported."
Black Shard's team can check your exposure, take a fix off your plate or step in on a live incident.
Severity
8.6of 10, high
Updated 15 Nov 2026, 15:45 UTC, 33 of 36 sources answering.
CISA Known Exploited Vulnerabilities, NVD, CVE.org, CIRCL Vulnerability-Lookup, GitHub Advisory Database (CC BY 4.0), OSV (CC BY 4.0), RansomLook (CC BY 4.0, enriched by Black Shard), SEC EDGAR, HHS breach portal, Have I Been Pwned (CC BY 4.0), Texas Attorney General, California Attorney General, Delaware Department of Justice, Vermont Attorney General, GDELT Project, Cloudflare status, abuse.ch SSLBL (CC0), CISA ICS advisories, NCSC UK (OGL v3.0), CERT-EU (CC BY 4.0), NCSC New Zealand (CC BY 4.0), MISP galaxy (CC0), OAIC determinations (CC BY 4.0), abuse.ch Feodo Tracker (CC0), Spamhaus DROP (Spamhaus DROP terms), blocklist.de, CINS Army, CERT-FR (Licence Ouverte 2.0), Red Hat Security Data (CC BY 4.0), ENISA EUVD, Microsoft MSRC, JVN iPedia, FIRST EPSS, IODA, GeoNames (CC BY 4.0), Natural Earth, Wikidata, Regional Internet Registries (delegation statistics), Protomaps, OpenStreetMap contributors (ODbL), NASA GIBS. Items link to their sources, except leak-site claims, which are never linked. This product uses the NVD API but is not endorsed or certified by the NVD.
Built on open-source software under the MIT licence. Map data from Natural Earth, NASA GIBS, Protomaps and OpenStreetMap contributors.
© 2026 Black Shard Pty LtdABN 66 696 910 773