$ cve CVE-2020-8515 JSON

CVE-2020-8515 KEV EXPLOIT

9.8

CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	99.99% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-78
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	yes
Published	2020-02-01
Last modified	2026-06-17

CISA KEV

Name	Multiple DrayTek Vigor Routers Web Management Page Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	DrayTek / Multiple Vigor Routers
Ransomware use	none reported

Affected (6)

Vendor	Product
draytek	vigor2960
draytek	vigor2960 firmware
draytek	vigor300b
draytek	vigor300b firmware
draytek	vigor3900
draytek	vigor3900 firmware

Public exploits

Source	Title	Date
exploit-db	Multiple DrayTek Products - Pre-authentication Remote Root Code Execution	2020-03-30

References

→ the Explorer · watch your stack · NVD