{"id":"CVE-2020-15415","aliases":["EUVD-2020-7408","GHSA-65hg-r7rx-55rg"],"status":"published","title":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi...","description":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.8448,"percentile":0.99705,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2020-06-30T13:37:56Z","modified":"2026-06-17T02:56:38Z","kev":{"date_added":"2024-09-30","due_date":"2024-10-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-09-30"},{"source":"kev","since":"2024-09-30"}],"exploits":[{"source":"nuclei","id":"CVE-2020-15415","title":"DrayTek Vigor - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15415.yaml"}],"products":[{"vendor":"draytek","product":"multiple vigor routers"},{"vendor":"draytek","product":"vigor2960_firmware"},{"vendor":"draytek","product":"vigor300b_firmware"},{"vendor":"draytek","product":"vigor3900_firmware"}],"references":[{"url":"https://www.draytek.com/about/security-advisory","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://github.com/CLP-team/Vigor-Commond-Injection","tags":["x_refsource_MISC","x_transferred","Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15415","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15415"},{"url":"https://github.com/advisories/GHSA-65hg-r7rx-55rg"}],"sources":{"cve":[{"id":"CVE-2020-15415","description":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.","status":"published","published":"2020-06-30T13:37:56Z","modified":"2025-10-21T23:35:41.567Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-7408","description":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.","status":"published","published":"2020-06-30T13:37:56Z","modified":"2025-10-21T23:35:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-09-30","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-65hg-r7rx-55rg","title":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi...","description":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.","status":"published","published":"2022-05-24T17:22:07Z","modified":"2025-10-22T00:32:58Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2020-15415","title":"DrayTek Multiple Vigor Routers OS Command Injection Vulnerability","description":"DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.","cwes":["CWE-78"],"kev":{"date_added":"2024-09-30","due_date":"2024-10-21","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2020-15415","description":"On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.","status":"published","published":"2020-06-30T14:15:11.953Z","modified":"2026-06-17T02:56:38.22Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:06:08.145904Z"}]}}