CVE-2020-8515
Published: November 3, 2021
Official Description
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
CISA KEV Advisory
Multiple DrayTek Vigor Routers Web Management Page Vulnerability
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
Apply updates per vendor instructions.
Risk Analysis
DrayTek Vigor3900, Vigor2960, and Vigor300B routers have an unspecified vulnerability that allows for remote code execution. The high EPSS score of 0.94357 indicates a very high likelihood of exploitation, and its inclusion in the KEV catalog confirms active exploitation.
This vulnerability is actively exploited in the wild. The flaw allows for remote code execution on affected DrayTek routers.
Update DrayTek Vigor3900, Vigor2960, and Vigor300B routers to the latest firmware versions to mitigate this remote code execution vulnerability. Ensure routers are not exposed directly to the internet unless absolutely necessary.
Technical Analysis
CVE-2020-8515 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2020-8515 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2020-8515 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1