CVE Watch—

CVE-2020-15415

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

CVSS

—

Sem CVSS

EPSS

84.5%

p100

KEV

SIM

30 de set. de 2024

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

84.5%EPSS · 30 dias84.5%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

DrayTek / Multiple Vigor Routers

Vulnerabilidade

DrayTek Multiple Vigor Routers OS Command Injection Vulnerability

Adicionado ao KEV

30 de set. de 2024

Corrigir até

21 de out. de 2024

Uso conhecido em ransomware

Não

Descrição resumida

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

Ação necessária

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notas

https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472) ; https://nvd.nist.gov/vuln/detail/CVE-2020-15415

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2020-8515—

100.0%

KEV—80Multiple DrayTek Vigor Routers Web Management Page Vulnerability—