CVE-2020-15415
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
Description
CVE-2020-15415 is a critical remote command execution vulnerability affecting DrayTek Vigor3900, Vigor2960, and Vigor300B enterprise routers running firmware versions before 1.5.1. An unauthenticated remote attacker can exploit a shell metacharacter injection flaw in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint to execute arbitrary operating system commands on the device. With a CVSS v3.1 base score of 9.8 and worst-case exploitability metrics, the vulnerability provides complete control over the affected network device without any authentication. CISA has added CVE-2020-15415 to the Known Exploited Vulnerabilities catalog with a remediation deadline of October 21, 2024, and the EPSS score of 93.00% at the 99.8th percentile confirms massive ongoing exploitation of internet-facing DrayTek devices.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| draytek | vigor3900 firmware | < 1.5.1 |
| draytek | vigor2960 firmware | < 1.5.1 |
| draytek | vigor300b firmware | < 1.5.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/CLP-team/Vigor-Commond-Injection(Exploit)
- https://www.draytek.com/about/security-advisory(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15415(US Government Resource)
Weakness Type
OS Command Injection via Shell Metacharacters
CVE-2020-15415 is an operating system command injection vulnerability caused by insufficient sanitization of user-supplied input in the file upload functionality of DrayTek Vigor routers. The vulnerability exists in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint, which handles configuration file uploads. When processing upload requests with a text/x-python-script content type, the CGI handler incorporates the filename parameter into shell commands without properly escaping shell metacharacters. An attacker can inject arbitrary commands by including metacharacters such as semicolons, backticks, or pipe characters in the filename field of the upload request. These injected commands execute with root privileges on the router's operating system, as embedded device web interfaces typically run with the highest privilege level.
Impact Analysis
Confidentiality is fully compromised by CVE-2020-15415. Remote command execution on an enterprise router grants the attacker access to all network traffic passing through the device, stored credentials including VPN keys and Wi-Fi passwords, routing configurations, firewall rules, and any data that the router processes or caches. DrayTek Vigor3900 and Vigor2960 are enterprise-class routers commonly deployed as network gateways, meaning they sit at the boundary between internal networks and the internet, providing maximum visibility into organizational communications.
Integrity faces maximum impact because root-level command execution on the router allows the attacker to modify routing tables, alter firewall rules, inject malicious DNS responses, intercept and modify traffic in transit, and install persistent firmware-level backdoors. An attacker controlling the network gateway can perform man-in-the-middle attacks against all internal users, redirect traffic to malicious servers, and manipulate any unencrypted communications flowing through the device.
Availability is also fully compromised, as the attacker can disrupt all network connectivity by modifying routing configurations, disabling interfaces, or rendering the device inoperable. For enterprises relying on DrayTek routers as their primary gateway, this means complete loss of internet connectivity and potentially all inter-site VPN communications. The EPSS score of 93.00% at the 99.8th percentile confirms that this is among the most exploited vulnerabilities in network infrastructure. While ransomware association is listed as unknown, compromised routers are frequently used as botnet nodes, VPN proxies for criminal infrastructure, or initial access points for deeper network intrusion.
Exploit Maturity
CVE-2020-15415 demonstrates the highest level of exploit maturity with confirmed widespread exploitation. Its inclusion in CISA's Known Exploited Vulnerabilities catalog and an EPSS score of 93.00% at the 99.8th percentile confirm massive targeting of vulnerable DrayTek devices.
A public proof-of-concept exploit is available on GitHub demonstrating the command injection technique. DrayTek has published a security advisory and released firmware version 1.5.1 that addresses the vulnerability. The exploitation is trivially simple, requiring only an HTTP request with crafted filename parameters to the vulnerable CGI endpoint. No authentication is needed (PR:N), no user interaction is required (UI:N), and the attack works over the network (AV:N) with low complexity (AC:L). DrayTek routers are frequently exposed to the internet for remote management, providing attackers with a large attack surface of easily discoverable targets through services like Shodan and Censys. The combination of internet-exposed devices, a trivially simple exploit, and public proof-of-concept code makes this vulnerability extremely attractive for botnet operators and network intrusion campaigns.
Remediation
-
Update DrayTek firmware to version 1.5.1 or later immediately. Download and install the latest firmware for your specific DrayTek model (Vigor3900, Vigor2960, or Vigor300B) from the DrayTek security advisory page. This is the most critical step, as the vulnerability allows unauthenticated remote command execution.
-
Disable remote management access from the internet. If remote management of the DrayTek router is enabled on the WAN interface, disable it immediately or restrict it to specific trusted IP addresses using access control lists. The vulnerable CGI endpoint is accessible through the web management interface, and disabling remote access eliminates the primary attack vector.
-
Conduct forensic analysis of affected devices. If your DrayTek router was running firmware before 1.5.1 with remote management exposed to the internet, assume it may have been compromised. Check for unauthorized configuration changes, modified DNS settings, added VPN accounts, altered firewall rules, and any signs of persistent backdoors. Compare the running configuration against a known-good baseline.
-
Rotate all credentials and secrets stored on or passing through the device. Change all administrative passwords, VPN pre-shared keys, certificate private keys, SNMP community strings, and any other credentials configured on the router. If the device was compromised, attackers may have extracted these secrets for persistent access or lateral movement.
-
Implement network monitoring for compromised device indicators. Monitor for unusual outbound connections from the DrayTek router to unexpected IP addresses, unexpected DNS query patterns, or anomalous traffic volumes that could indicate the device is being used as a proxy, botnet node, or data exfiltration point. Deploy intrusion detection signatures specific to DrayTek exploitation patterns.
Technical Details
CVE-2020-15415 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, yielding a critical base score of 9.8. Every exploitability metric represents the worst case: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N).
The vulnerability exists in the cgi-bin/mainfunction.cgi/cvmcfgupload CGI endpoint on DrayTek Vigor3900, Vigor2960, and Vigor300B routers. This endpoint handles configuration file uploads and is part of the device's web management interface. When a request is sent with the Content-Type header set to text/x-python-script, the CGI handler processes the uploaded filename parameter in an insecure manner, passing it directly to shell command execution functions without sanitizing shell metacharacters.
An attacker can inject arbitrary commands by including characters like semicolons (;), backticks (`), pipe operators (|), or command substitution syntax ($(...)) in the filename field of a multipart form upload. For example, a filename containing ; id; would cause the router to execute the id command in addition to the intended file processing. Since the web server on DrayTek routers runs with root privileges (as is common on embedded Linux devices), all injected commands execute as root, providing complete control over the device.
This vulnerability is distinct from CVE-2020-14472, which is a separate command injection issue in the same product line. The scope is unchanged (S:U), meaning the vulnerability directly impacts the router device itself, but the practical consequences extend to all network traffic and connected devices that depend on the router for connectivity and security. Affected devices include the Vigor3900 (enterprise VPN concentrator), Vigor2960 (dual-WAN security router), and Vigor300B (enterprise load-balancing router), all running firmware versions prior to 1.5.1.
Frequently Asked Questions
What is CVE-2020-15415?
CVE-2020-15415 is a critical remote command execution vulnerability in DrayTek Vigor3900, Vigor2960, and Vigor300B routers that allows an unauthenticated attacker to execute arbitrary commands on the device by injecting shell metacharacters through the configuration upload endpoint. It has a CVSS score of 9.8 and is actively exploited in the wild.
How can I check if my DrayTek router is vulnerable?
Log into your DrayTek router's web management interface and check the firmware version displayed on the dashboard or system status page. If your Vigor3900, Vigor2960, or Vigor300B is running firmware earlier than version 1.5.1, it is vulnerable. You should update the firmware immediately.
Can this vulnerability be exploited from the internet?
Yes, if the router's web management interface is accessible from the internet (WAN side). Many DrayTek deployments enable remote management for convenience, which directly exposes the vulnerable CGI endpoint. Even without remote management enabled, the vulnerability may be exploitable from the LAN side by any device connected to the internal network.
What are the signs my DrayTek router was compromised?
Look for unauthorized configuration changes such as modified DNS servers, new VPN accounts, altered firewall rules, or unexpected port forwarding entries. Check for unusual outbound network connections from the router itself, changes to the administrator password, or degraded network performance. If remote management was exposed to the internet, the risk of prior compromise is very high.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.