CVE-2020-8515
Multiple DrayTek Vigor Routers Web Management Page Vulnerability
Description
CVE-2020-8515 is a CRITICAL severity remote code execution vulnerability in multiple DrayTek Vigor router models, classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The flaw allows unauthenticated remote attackers to execute arbitrary commands as root by injecting shell metacharacters into the cgi-bin/mainfunction.cgi URI on the web management interface. With a CVSS 3.1 score of 9.8, this vulnerability provides complete control over affected routers without requiring any authentication. Affected devices include DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B versions 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta. CISA added CVE-2020-8515 to its KEV catalog on November 3, 2021. The EPSS score of 0.94357 (99.96th percentile) indicates an extremely high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| draytek | vigor2960 firmware | 1.3.1 |
| draytek | vigor300b firmware | 1.3.3; 1.4.2.1; 1.4.4 |
| draytek | vigor3900 firmware | 1.4.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html(Permissions Required, Third Party Advisory)
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8515(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS Command Injection occurs when software constructs operating system commands using externally-supplied input without properly neutralizing special elements that could modify the intended command. When user-controlled data is passed directly to a system shell or command interpreter without adequate sanitization, attackers can inject additional commands by using shell metacharacters such as semicolons, pipes, backticks, or command substitution operators. The injected commands execute with the privileges of the vulnerable application.
In the context of CVE-2020-8515, the DrayTek Vigor router web management interface processes user input through the cgi-bin/mainfunction.cgi endpoint. The CGI handler passes certain input parameters directly to shell commands executed on the router's operating system without sanitizing shell metacharacters. Because the web management interface runs with root privileges on the router, injected commands execute as root, giving the attacker complete control over the device. This allows attackers to modify router configurations, intercept network traffic, install persistent backdoors, and use the compromised router as a pivot point for further network attacks.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2020-8515 carries a CVSS 3.1 base score of 9.8 (CRITICAL) with network-exploitable attack characteristics requiring no authentication.
Confidentiality (High): Successful exploitation grants root-level access to the router, exposing all device configurations including VPN credentials, wireless network keys, DHCP settings, firewall rules, and any stored user credentials. The attacker can also monitor and intercept all network traffic passing through the router, capturing sensitive data such as authentication credentials, emails, and unencrypted communications from all connected devices.
Integrity (High): With root access, the attacker can modify any aspect of the router configuration including DNS settings (enabling DNS hijacking), firewall rules (opening additional attack surfaces), routing tables (redirecting traffic through attacker-controlled systems), and VPN configurations. The attacker can also modify the router firmware to install persistent backdoors that survive factory resets.
Availability (High): The attacker can render the router inoperable by corrupting its firmware, modifying critical configurations, or deliberately overloading its resources. Since DrayTek Vigor routers serve as network gateways for businesses and branch offices, disrupting the router effectively disconnects all connected devices and services from the network.
Scope (Unchanged): While the CVSS scope is unchanged, the practical impact extends well beyond the router itself. A compromised network gateway provides the attacker with a man-in-the-middle position for all network traffic and a persistent foothold for lateral movement into the internal network. The EPSS score of 0.94357 (99.96th percentile) places this in the top 0.04% of all CVEs.
Exploit Maturity
Active Exploitation: CVE-2020-8515 is actively exploited in the wild. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog on November 3, 2021, with a mandatory remediation deadline of May 3, 2022 for federal agencies. Multiple threat actor groups have been observed exploiting this vulnerability to compromise DrayTek routers for various malicious purposes.
Public Exploits: A complete exploit for remote command execution on DrayTek Vigor routers is publicly available on Packet Storm Security. The exploit demonstrates how to inject shell metacharacters through the web management interface to execute arbitrary commands as root.
Widespread Targeting: DrayTek Vigor routers are widely deployed in small and medium businesses, particularly in Europe and Asia-Pacific regions. The combination of internet-exposed management interfaces and unauthenticated exploitation makes these devices highly attractive targets for botnet operators, APT groups, and cybercriminals seeking network footholds.
EPSS Context: The EPSS score of 0.94357 (99.96th percentile) places this vulnerability in the top 0.04% of all CVEs for exploitation probability. This exceptionally high score reflects the combination of trivial exploitation, no authentication requirement, and wide device deployment.
KEV Deadline: Federal agencies were required to remediate by May 3, 2022. All organizations using affected DrayTek Vigor routers should update firmware immediately.
Remediation
-
Update DrayTek Vigor router firmware to version 1.5.1 or later immediately. DrayTek released firmware version 1.5.1 for Vigor3900, Vigor2960, and Vigor300B that addresses this vulnerability. Download the firmware from the DrayTek security advisory.
-
Disable remote management access immediately as an interim measure. If firmware cannot be updated right away, disable the web management interface from being accessible over the WAN. Only allow management access from the local network or through a VPN connection.
-
Check for indicators of compromise on affected routers. Review router configurations for unauthorized changes including modified DNS settings, unexpected firewall rules, new VPN accounts, and unknown static routes. Check for any persistent backdoor mechanisms such as scheduled tasks or modified startup scripts.
-
Reset router configurations after firmware update. After updating the firmware, perform a factory reset and reconfigure the router from scratch rather than restoring a potentially compromised configuration backup. This ensures any attacker modifications or backdoors are completely removed.
-
Implement network segmentation behind the router. Even after patching, implement additional network security layers such as internal firewalls, VLAN segmentation, and intrusion detection systems to limit the blast radius if a network edge device is compromised in the future.
-
Establish a firmware update process for network devices. DrayTek Vigor routers and similar network appliances require regular firmware updates. Implement a process for monitoring vendor security advisories and applying firmware updates promptly across all network devices.
Technical Details
CVE-2020-8515 is a pre-authentication remote code execution vulnerability in the web management interface of multiple DrayTek Vigor router models. The affected devices include Vigor2960 version 1.3.1_Beta, Vigor3900 version 1.4.4_Beta, and Vigor300B versions 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta.
The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the maximum exploitability characteristics: the attack is conducted over the network, requires no authentication, needs no user interaction, and has low complexity. The high impact across all three CIA dimensions reflects the root-level command execution achieved through exploitation.
The vulnerability exists in the cgi-bin/mainfunction.cgi handler of the router's web management interface. This CGI endpoint processes various management functions and accepts user input parameters. The handler constructs operating system commands by concatenating user-supplied values directly into shell command strings without proper sanitization of shell metacharacters.
An attacker can inject shell metacharacters such as semicolons, backticks, or command substitution operators (e.g., $(command)) into the vulnerable parameters. When the CGI handler processes the request, the injected metacharacters break out of the intended command context and execute the attacker's arbitrary commands. Because the web management interface runs as root on the embedded Linux operating system of the router, all injected commands execute with full root privileges.
The attack requires only network access to the router's web management interface, which is often exposed on the WAN interface for remote administration. No authentication is needed, making this vulnerability exploitable by any attacker who can reach the management port. The public exploit on Packet Storm Security provides a complete proof-of-concept that automates the injection process, making exploitation trivial even for less skilled attackers.
DrayTek fixed this vulnerability in firmware version 1.5.1 by implementing proper input sanitization for the affected CGI parameters, preventing shell metacharacter injection.
Frequently Asked Questions
Is CVE-2020-8515 being actively exploited?
Yes, CVE-2020-8515 is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2021. Multiple threat actor groups have been observed targeting DrayTek Vigor routers through this vulnerability. The EPSS score of 0.94357 (99.96th percentile) places it in the top 0.04% of all CVEs for exploitation probability.
What products are affected by CVE-2020-8515?
The following DrayTek Vigor router models and firmware versions are affected: Vigor2960 version 1.3.1_Beta, Vigor3900 version 1.4.4_Beta, and Vigor300B versions 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta. These are enterprise-class VPN routers commonly deployed in small and medium businesses. The vulnerability has been fixed in firmware version 1.5.1.
How do I fix CVE-2020-8515?
Update the affected DrayTek Vigor router firmware to version 1.5.1 or later. As an immediate interim measure, disable WAN-side access to the web management interface. After updating, perform a factory reset and reconfigure the router from scratch to eliminate any potential backdoors. Check for signs of compromise including modified DNS settings, unexpected firewall rules, and unauthorized VPN accounts.
How severe is CVE-2020-8515?
CVE-2020-8515 is rated CRITICAL with the maximum CVSS score of 9.8. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands as root on affected DrayTek Vigor routers. This grants complete control over the device and all network traffic passing through it. The EPSS score of 0.94357 (99.96th percentile) confirms this is among the most actively targeted vulnerabilities, reflecting the combination of trivial exploitation and wide deployment of affected devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.