Vulnerability · CVE-2020-8515

Multiple DrayTek Vigor Routers Web Management Page Vulnerability

Published Feb 1, 2020 · corrected/updated Jun 16, 2026 · DrayTek Vigor Routers · evidence confidence very high

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2020-8515 is a critical public vulnerability record for DrayTek Vigor Routers. CISA lists it as known exploited. Published remediation guidance: Apply updates per vendor instructions. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether DrayTek Vigor Routers is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: draytek/vigor2960 firmware (1.3.1); draytek/vigor300b firmware (1.3.3); draytek/vigor300b firmware (1.4.2.1); draytek/vigor300b firmware (1.4.4). Published remediation guidance: Apply updates per vendor instructions. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 9.8, EPSS 100.0%. CISA lists it as known exploited. Weakness classes: CWE-78. Sources contributing to this record: cisa_kev, cve_org, epss, exploitdb. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Confirmed in CISA KEV since Apr 3, 2020. Listed in CISA KEV and VulnCheck KEV.
Patch and remediation
Apply updates per vendor instructions. CISA due date May 3, 2022.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Feb 1, 2020 · Catalog
Detected
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

Affected

cpe draytek/vigor2960 firmware1.3.1
cpe draytek/vigor300b firmware1.3.3
cpe draytek/vigor300b firmware1.4.2.1
cpe draytek/vigor300b firmware1.4.4
cpe draytek/vigor3900 firmware1.4.4
vendor DrayTek Multiple Vigor Routersversion unspecified
vendor DrayTek Vigor Routersversion unspecified

Sources

CISA KEVConfirmed exploitationCVE-2020-8515
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
cisa.gov
CVE.orgVulnerability recordCVE-2020-8515
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2020-8515
30-day exploitation probability 100.0%
first.org
Exploit DatabasePublic exploit reference48268
Public archive entry. The exploit body is not stored here.
exploit-db.com
NIST NVDVulnerability recordCVE-2020-8515
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/296
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/156979/DrayTek-Vigor2960-Vigor3900-Vigor300B-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
VulnCheck KEVConfirmed exploitationCVE-2020-8515
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
vulncheck.com