CVE-2020-15415

DrayTek Vigor3900, Vigor2960, and Vigor300B routers running firmware before 1.5.1 contain an unauthenticated OS command injection flaw (CWE-78) in the cvmcfgupload handler of the web management interface (cgi-bin/mainfunction.cgi/cvmcfgupload), distinct from CVE-2020-14472. A remote attacker sends an upload request using the text/x-python-script content type with shell metacharacters embedded in the filename, which the device passes to a shell without sanitization, achieving arbitrary command execution. Because no credentials or user interaction are required, an internet-exposed management interface can be fully compromised, giving the attacker control of the router and a foothold into the network behind it. Any organization or site running one of these three Vigor models on pre-1.5.1 firmware is affected, especially where the web UI is reachable from the internet. Exploitation is confirmed: a public proof-of-concept exists, EPSS rates 30-day exploitation probability at 84.5% (100th percentile), CISA added the bug to the Known Exploited Vulnerabilities catalog on 2024-09-30, and recent reporting ties Mirai V3G4 botnet activity to campaigns exploiting a batch of 13 IoT flaws.

What to do: Upgrade Vigor3900, Vigor2960, and Vigor300B firmware to version 1.5.1 or later per DrayTek's instructions, consistent with the CISA KEV required action (apply vendor mitigations or discontinue use). Until patched, do not expose the web management interface to the internet (restrict to trusted management IPs or VPN access) and hunt for compromise indicators such as unexpected processes, altered configurations, or Mirai-like scanning traffic. Check access logs for requests to /cgi-bin/mainfunction.cgi/cvmcfgupload using the text/x-python-script content type with metacharacters in the filename.