ZeroDay Findings
Sign inSign up

Findings

CVE-2020-15415

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

Published Jun 30, 2020 · updated Jun 16, 2026 · draytek vigor3900 firmware

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

Timeline

Detection, updates, and resolution for this record.

  1. Jun 30, 2020 · Catalog

    Detected

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

  2. Sep 30, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Oct 21, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Oct 21, 2024

Affected

  • cpe draytek/vigor2960 firmwareversion unspecified
  • cpe draytek/vigor300b firmwareversion unspecified
  • cpe draytek/vigor3900 firmwareversion unspecified
  • vendor DrayTek Multiple Vigor Routersversion unspecified

Sources

  • CISA KEVCVE-2020-15415

    DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

    cisa.gov
  • CVE.orgCVE-2020-15415

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-15415

    30-day exploitation probability 84.5%

    first.org
  • NIST NVDCVE-2020-15415

    On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

    nvd.nist.gov

References