CVE-2020-15415 DrayTek Multiple Vigor Routers OS Command Injection

Exploited in the wild Critical 9.8 Published 30 Jun 2020 Updated 21 Oct 2025

Remote attackers can execute arbitrary commands on DrayTek routers by injecting shell metacharacters into filenames during file uploads.

Exploited in the wild: Since 30 Sep 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-15415?

CVE-2020-15415 is a critical command injection vulnerability in n/a, published on 30 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

Weakness: CWE-78

Which versions are affected by CVE-2020-15415?

It affects 3 products.

Products include Draytek Vigor2960 Firmware, Draytek Vigor300b Firmware, Draytek Vigor3900 Firmware.

How do I fix CVE-2020-15415?

No fix has been published for CVE-2020-15415 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 21 Oct 2024.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-15415 being exploited?

Yes. Attackers have exploited CVE-2020-15415 in the wild since at least 30 Sep 2024.

Public exploit code: 1 Nuclei template.

Sources

Also known as GHSA-65hg-r7rx-55rg.