Secuno
ENNL
Book demo

CVE-2020-15415

DrayTek Multiple Vigor Routers OS Command Injection

9.8 CRITICALActively exploited (CISA KEV)Public exploitEPSS 84.5%
  1. Published30 Jun 2020
  2. Added to CISA KEV30 Sept 2024
  3. Remediation due21 Oct 2024
Actively exploited (CISA KEV)

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

Added to KEV: 30 Sept 2024Federal remediation due: 21 Oct 2024

Description

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Draytek Vigor2960 Firmware< 1.5.1
Draytek Vigor300b Firmware< 1.5.1
Draytek Vigor3900 Firmware< 1.5.1

Remediation

Fixed in
Draytek Vigor2960 Firmware≥ 1.5.1
Draytek Vigor300b Firmware≥ 1.5.1
Draytek Vigor3900 Firmware≥ 1.5.1

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-10911010.0
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function…
CVE-2026-1091089.9
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This…
CVE-2026-820968.8
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker…
CVE-2026-185298.7
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is…
CVE-2025-714299.8
GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in…
CVE-2020-372798.1
easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that…

Frequently asked

Is CVE-2020-15415 being actively exploited?

Yes. CVE-2020-15415 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 30 Sept 2024.

How severe is CVE-2020-15415?

CVE-2020-15415 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 84.5% probability of exploitation.

Which products are affected by CVE-2020-15415?

Affected products include Draytek Vigor2960 Firmware, Draytek Vigor300b Firmware, Draytek Vigor3900 Firmware.

How do I fix CVE-2020-15415?

Upgrade affected software to a fixed version, for example Draytek Vigor2960 Firmware 1.5.1, Draytek Vigor300b Firmware 1.5.1, Draytek Vigor3900 Firmware 1.5.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2020-15415 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.