CVE-2023-1009

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is the function sub_1DF14 of the file /cgi-bin/mainfunction.cgi of the component Web Management Interface. The manipulation of the argument option with the input /../etc/passwd- leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-221742 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

• CWE-22

• https://github.com/xxy1126/Vuln/blob/main/Draytek/1.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.221742Permissions Required
• https://vuldb.com/?id.221742Third Party Advisory
• https://github.com/xxy1126/Vuln/blob/main/Draytek/1.mdExploit, Third Party Advisory
• https://vuldb.com/?ctiid.221742Permissions Required
• https://vuldb.com/?id.221742Third Party Advisory

Published

Feb 24, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1003A vulnerability, which was classified as critical, was found…7.8
• CVE-2023-1004A vulnerability has been found in MarkText up to 0.17.1 on W…7.8
• CVE-2023-1005A vulnerability was found in JP1016 Markdown-Electron and cl…7.8
• CVE-2023-1006A vulnerability was found in SourceCodester Medical Certific…5.4
• CVE-2023-1007A vulnerability was found in Twister Antivirus 8.17. It has …7.8
• CVE-2023-1008A vulnerability was found in Twister Antivirus 8.17. It has …5.5
• CVE-2023-1010A vulnerability classified as critical was found in vox2png …5.5
• CVE-2023-1011The AI ChatBot WordPress plugin before 4.4.5 does not escape…6.1
• CVE-2023-1013Improper Neutralization of Script-Related HTML Tags in a Web…6.1
• CVE-2023-1014Improper Protection for Outbound Error Messages and Alert Si…7.5
• CVE-2023-1015Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-1016The Intuitive Custom Post Order plugin for WordPress is vuln…7.2