DrayTek · Multiple Vigor Routers

CVE-2020-15415

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 84%

What it is

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

CISA: DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: October 21, 2024

Added to the CISA list: September 30, 2024
Published: June 30, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 84% in the top 0.3% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from DrayTek

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Multiple DrayTek Vigor Routers Web Management PageCVE-2020-8515	Multiple Vigor Routers	Critical 9.8	>99.9%
May 15, 2025	OS Command InjectionCVE-2024-12987	Vigor Routers	Medium 6.9	98%
Sep 3, 2024	Path Traversal Vulnerability CVE-2021-20123	VigorConnect	High 7.5	90%
Sep 3, 2024	Path Traversal Vulnerability CVE-2021-20124	VigorConnect	High 7.5	96%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.