Is CVE-2020-15415 actively exploited?

Yes. CVE-2020-15415 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-15415 be exploited remotely?

The attack vector of CVE-2020-15415 has not been classified yet.

What is the CVSS score of CVE-2020-15415?

CVE-2020-15415 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-15415

HIGHCISA KEVIN THE WILD

CVE-2020-15415

Published: September 30, 2024

EPSS:93.00%probability of exploitation in 30 daysPercentile:99.8th

Official Description

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

NVD Source

CISA KEV Advisory

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

Added to KEV: 2024-09-30Federal patch deadline: 2024-10-21

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This vulnerability in DrayTek Vigor3900, Vigor2960, and Vigor300B devices allows for remote code execution through OS command injection. An attacker can achieve this by using shell metacharacters in a filename with a specific content type. The high EPSS score of 0.93003 highlights a significant probability of exploitation, making this a high-priority vulnerability.

This vulnerability is actively being exploited in the wild and is listed in CISA's KEV catalog, indicating confirmed exploitation. The remote nature of the vulnerability makes it a serious threat.

Recommended Action

DrayTek users should apply the latest firmware updates for Vigor3900, Vigor2960, and Vigor300B devices to mitigate this vulnerability. Reviewing and restricting file upload functionalities can also help reduce risk.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-15415 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-15415 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.