Lucene search

MitreCVE-2020-15415

HistoryJun 30, 2020 - 2:15 p.m.

CVE-2020-15415

2020-06-3014:15:11

CWE-78

mitre

web.nvd.nist.gov

In Wild

cve-2020-15415

draytek

vigor3900

vigor2960

vigor300b

remote command execution

shell metacharacters

security vulnerability

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.943

Percentile

99.3%

JSON

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

Affected configurations

Nvd

Node

draytekvigor3900_firmwareRange<1.5.1

AND

draytekvigor3900Match-

Node

draytekvigor2960_firmwareRange<1.5.1

AND

draytekvigor2960Match-

Node

draytekvigor300b_firmwareRange<1.5.1

AND

draytekvigor300bMatch-

VendorProductVersionCPE
draytekvigor3900_firmware*cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:*
draytekvigor3900-cpe:2.3:h:draytek:vigor3900:-:*:*:*:*:*:*:*
draytekvigor2960_firmware*cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
draytekvigor2960-cpe:2.3:h:draytek:vigor2960:-:*:*:*:*:*:*:*
draytekvigor300b_firmware*cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*
draytekvigor300b-cpe:2.3:h:draytek:vigor300b:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
draytek	vigor3900_firmware	*	cpe:2.3:o:draytek:vigor3900_firmware::::::::
draytek	vigor3900	-	cpe:2.3:h:draytek:vigor3900:-:::::::*
draytek	vigor2960_firmware	*	cpe:2.3:o:draytek:vigor2960_firmware::::::::
draytek	vigor2960	-	cpe:2.3:h:draytek:vigor2960:-:::::::*
draytek	vigor300b_firmware	*	cpe:2.3:o:draytek:vigor300b_firmware::::::::
draytek	vigor300b	-	cpe:2.3:h:draytek:vigor300b:-:::::::*

References

github.com/CLP-team/Vigor-Commond-Injection

www.draytek.com/about/security-advisory

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.943

Percentile

99.3%

JSON

Related for CVE-2020-15415