Exploited· due 2024-10-21

CVE-2020-15415

DrayTek Multiple Vigor Routers

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

Exploitation status

  • CISA has confirmed this is being exploited in the wild. That is an observation of real attacks, not a prediction.
  • US federal civilian agencies are required to remediate it by 2024-10-21. That deadline does not bind private companies, but it is a reasonable benchmark for how urgently CISA views it.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA’s wording, unedited.

Scoring

CVSS
Not yet scored

Dates

Published
2024-09-30
Added to KEV
2024-09-30
Remediation due
2024-10-21
Sources
CISA KEV