CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2020-15415
Critical (9.8) in DrayTek Multiple Vigor Routers. In CISA KEV since 2024-09-30. EPSS 84% chance of exploitation in the next 30 days.
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.
Severity
- EPSS
- 84% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2024-09-30, due 2024-10-21
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- draytek:vigor2960_firmware
- draytek:vigor300b_firmware
- draytek:vigor3900_firmware