CVE-2020-8515

🗓️ 01 Feb 2020 12:36:59Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 1535 Views🌐 WEB

DrayTek Vigor2960/3900/300B devices allow remote code execution as root without authentication via cgi-bin/mainfunction.cgi URI. Fixed in Vigor3900/2960/300B v1.5.1

Reporter	Title	Published	Views	Family All 35
0day.today	DrayTek Products - Pre-authentication Remote Root Code Execution Exploit	30 Mar 202000:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Draytek Vigor2960_Firmware	1 Sep 202122:47	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Draytek Vigor2960_Firmware	30 Mar 202003:31	–	githubexploit
ICS	Potential for China Cyber Response to Heightened U.S.–China Tensions	20 Oct 202012:00	–	ics
ICS	People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices	10 Jun 202212:00	–	ics
ATTACKERKB	CVE-2020-8515	1 Feb 202000:00	–	attackerkb
BDU FSTEC	The vulnerability of the WebUI interface of Vigor3900 / Vigor2960 / Vigor300B routers allows a hacker to execute arbitrary code with root privileges.	6 Sep 202100:00	–	bdu_fstec
Circl	CVE-2020-8515	27 Mar 202023:08	–	circl
CISA KEV Catalog	Multiple DrayTek Vigor Routers Web Management Page Vulnerability	3 Nov 202100:00	–	cisa_kev
CISA	MS-ISAC Releases Advisory on DrayTek Devices	1 Apr 202000:00	–	cisa

NVD

Node

AND

draytek vigor2960_firmwareMatch1.3.1beta

draytek vigor2960Match-

Node

AND

draytek vigor300b_firmwareMatch1.3.3beta

draytek vigor300b_firmwareMatch1.4.2.1beta

draytek vigor300b_firmwareMatch1.4.4beta

draytek vigor300bMatch-

Node

AND

draytek vigor3900_firmwareMatch1.4.4beta

draytek vigor3900Match-

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html
draytek	www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/
sku11army	www.sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
action	request body	/cgi-bin/mainfunction.cgi	DrayTek pre-auth remote root RCE via mainfunction.cgi (unauthenticated) using crafted keyPath in POST form to execute shell commands.	CWE-78
keyPath	request body	/cgi-bin/mainfunction.cgi	DrayTek pre-auth remote root RCE via mainfunction.cgi (unauthenticated) using crafted keyPath in POST form to execute shell commands.	CWE-78
loginUser	request body	/cgi-bin/mainfunction.cgi	DrayTek pre-auth remote root RCE via mainfunction.cgi (unauthenticated) using crafted keyPath in POST form to execute shell commands.	CWE-78
loginPwd	request body	/cgi-bin/mainfunction.cgi	DrayTek pre-auth remote root RCE via mainfunction.cgi (unauthenticated) using crafted keyPath in POST form to execute shell commands.	CWE-78

17 Jun 2026 03:26Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

CVSS 210

EPSS0.99993

SSVC