CVE-2020-15415

CRITICAL KEV NUCLEI

DrayTek Vigor3900/Vigor2960/Vigor300B <1.5.1 - RCE

Title source: llm

Exploitation Summary

CVE-2020-15415 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 30, 2024. A Nuclei detection template is also available.

Description

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

Nuclei Templates (1)

DrayTek Vigor - Command Injection

CRITICALVERIFIEDby ritikchaddha

FOFA: "excanvas.js" && "lang == \"zh-cn\"" && "detectLang" && server=="DWS"

References (3)

Core 3

Core References

Vendor Advisory x_refsource_misc

https://www.draytek.com/about/security-advisory

Exploit x_refsource_misc

https://github.com/CLP-team/Vigor-Commond-Injection

View Exploit ZIP pw:eip

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15415

Scores

CVSS v3 9.8

EPSS 0.9300

EPSS Percentile 99.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable yes

Technical Impact total

Details

CISA KEV 2024-09-30

VulnCheck KEV 2023-02-15

InTheWild.io 2021-01-22

ENISA EUVD EUVD-2020-7408

CWE

CWE-78

Status published

Products (3)

draytek/vigor2960_firmware < 1.5.1

draytek/vigor300b_firmware < 1.5.1

draytek/vigor3900_firmware < 1.5.1

Published Jun 30, 2020

KEV Added Sep 30, 2024

Tracked Since Feb 18, 2026