{"id":"CVE-2020-8515","aliases":["EUVD-2020-29381","GHSA-4866-p686-25f3"],"status":"published","title":"DrayTek Vigor2960 1.3.1_Beta; Vigor3900 1.4.4_Beta; and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1...","description":"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.99993,"percentile":0.99987,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-74","CWE-78"],"published":"2020-02-01T12:36:59Z","modified":"2026-06-17T03:26:30Z","kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2021-11-03"},{"source":"kev","since":"2021-11-03"}],"exploits":[{"source":"exploitdb","id":"EDB-48268","title":"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution","type":"remote","platform":"linux","date":"2020-03-30","url":"https://www.exploit-db.com/exploits/48268"},{"source":"pocgithub","id":"imjdl/CVE-2020-8515-PoC","title":"imjdl/CVE-2020-8515-PoC","date":"2020-03-30","url":"https://github.com/imjdl/CVE-2020-8515-PoC"},{"source":"pocgithub","id":"truerandom/nmap_draytek_rce","title":"truerandom/nmap_draytek_rce","date":"2020-03-31","url":"https://github.com/truerandom/nmap_draytek_rce"},{"source":"pocgithub","id":"darrenmartyn/CVE-2020-8515","title":"darrenmartyn/CVE-2020-8515","date":"2021-09-01","url":"https://github.com/darrenmartyn/CVE-2020-8515"},{"source":"nuclei","id":"CVE-2020-8515","title":"DrayTek - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8515.yaml"}],"products":[{"vendor":"draytek","product":"multiple vigor routers"},{"vendor":"draytek","product":"vigor2960_firmware"},{"vendor":"draytek","product":"vigor300b_firmware"},{"vendor":"draytek","product":"vigor3900_firmware"}],"references":[{"url":"https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html","tags":["x_refsource_MISC","x_transferred","Permissions Required","Third Party Advisory"]},{"url":"https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8515","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8515"},{"url":"https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29"},{"url":"https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)"},{"url":"https://github.com/advisories/GHSA-4866-p686-25f3"}],"sources":{"cve":[{"id":"CVE-2020-8515","description":"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.","status":"published","published":"2020-02-01T12:36:59Z","modified":"2025-10-21T23:35:52.845Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29381","description":"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.","status":"published","published":"2020-02-01T12:36:59Z","modified":"2025-10-21T23:35:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2021-11-03","updated_at":"2026-11-02T20:31:24.816637Z"}],"ghsa":[{"id":"GHSA-4866-p686-25f3","title":"DrayTek Vigor2960 1.3.1_Beta; Vigor3900 1.4.4_Beta; and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1...","description":"DrayTek Vigor2960 1.3.1_Beta; Vigor3900 1.4.4_Beta; and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI.","status":"published","published":"2022-05-24T17:07:51Z","modified":"2025-10-22T00:32:54Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-74","CWE-78"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2020-8515","title":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability","description":"DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.","cwes":["CWE-78"],"kev":{"date_added":"2021-11-03","due_date":"2022-05-03","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:17.050017Z"}],"nvd":[{"id":"CVE-2020-8515","description":"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.","status":"published","published":"2020-02-01T13:15:12.623Z","modified":"2026-06-17T03:26:30.047Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:53.837808Z"}]}}