{"id":"CVE-2020-8515","published":"2020-02-01T13:15:12Z","modified":"2026-06-17T03:26:30Z","title":"Multiple DrayTek Vigor Routers Web Management Page Vulnerability","vendor":"DrayTek","product":"Multiple Vigor Routers","tier":"core","eol":null,"description":{"text":"DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.","provenance":"source","from":"NVD"},"summary":{"text":"DrayTek Vigor routers (Vigor2960, Vigor3900, and Vigor300B in the listed beta releases) contain an OS command injection flaw in the web management interface, where the cgi-bin/mainfunction.cgi endpoint fails to neutralise shell metacharacters. An attacker with network access to the device can execute commands as root without authenticating and without any user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:45Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99993,"percentile":0.99987,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-8515","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-04-03","exploitedFirstSeen":"2020-04-03","ransomware":false,"evidence":[{"url":"https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/","date":"2020-04-03"},{"url":"https://www.radware.com/security/ddos-threats-attacks/threat-advisories-attack-reports/hoaxcalls-evolution/","date":"2020-04-21"},{"url":"https://blog.radware.com/security/botnets/2020/05/whos-viktor-tracking-down-the-xtc-polaris-botnets/","date":"2020-05-07"},{"url":"https://blog.radware.com/security/botnets/2020/05/ghosting-bots-the-story-of-hoaxcalls-failures/","date":"2020-05-28"},{"url":"https://blog.netlab.360.com/ddos-botnet-moobot-en/","date":"2020-07-09"},{"url":"https://unit42.paloaltonetworks.com/iot-vulnerabilities-mirai-payloads/","date":"2020-10-14"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/Security%20Quarterly%20Report.pdf","date":"2021-06-02"}],"evidenceTotal":894,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html","tags":["Permissions Required","Third Party Advisory"]},{"url":"https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8515","tags":["US Government Resource"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2020-8515 is a command injection vulnerability affecting certain DrayTek devices, This vulnerability allows an attacker to make arbitrary commands on the affected devices without authentication. Successful exploitation has been reported leading to resource hijacking for botnet use.","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-29381","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29381","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48268,"url":"https://www.exploit-db.com/exploits/48268","title":"Multiple DrayTek Products - Pre-authentication Remote Root Code Execution","type":"remote","platform":"linux","date":"2020-03-30","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-03-30"},"pocGithub":{"count":3,"skipped":0,"earliest":"2020-03-30","earliestUrl":"https://github.com/imjdl/CVE-2020-8515-PoC","repos":[{"name":"imjdl/CVE-2020-8515-PoC","url":"https://github.com/imjdl/CVE-2020-8515-PoC","stars":14,"created":"2020-03-30"},{"name":"darrenmartyn/CVE-2020-8515","url":"https://github.com/darrenmartyn/CVE-2020-8515","stars":5,"created":"2021-09-01"},{"name":"truerandom/nmap_draytek_rce","url":"https://github.com/truerandom/nmap_draytek_rce","stars":3,"created":"2020-03-31"}]},"nuclei":[{"id":"CVE-2020-8515","name":"DrayTek - Remote Code Execution","severity":"critical","path":"http/cves/2020/CVE-2020-8515.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8515.yaml"}],"first":{"date":"2020-03-30","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/48268"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1059"],"provenance":"source"},{"stage":"secondary","techniques":["T1496"],"provenance":"source"}],"timeline":[{"date":"2020-02-01","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8515","provenance":"source"},{"date":"2020-03-30","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-48268); later: PoC-in-GitHub 2020-03-30","url":"https://www.exploit-db.com/exploits/48268","provenance":"source"},{"date":"2020-04-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://unit42.paloaltonetworks.com/new-hoaxcalls-ddos-botnet/","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29381","provenance":"source"}],"speed":{"daysToPublicExploit":58,"firstExploitFrom":"Exploit-DB","daysToKev":641},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2402 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 3 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}