60
CVE-2020-8515
KEV PoC largeUnauthenticated Command Injection RCE in DrayTek Vigor3900/2960/300B Routers
CISA: Multiple DrayTek Vigor Routers Web Management Page Vulnerability
CVSS 3.1
9.8 critical
EPSS
100%p100
Published
()
KEV added
AI analysis
CVE-2020-8515 is an unauthenticated OS command injection flaw (CWE-78) in the web management page of DrayTek Vigor3900, Vigor2960, and Vigor300B routers. An attacker can trigger it by sending crafted, unauthenticated HTTP requests to the router's management web interface, injecting shell metacharacters into commands executed by the device. Successful exploitation yields remote code execution on the router, allowing an attacker to install web shells, alter firewall/VPN settings, intercept traffic, or pivot into the protected network. Any organization running affected Vigor3900/2960/300B firmware with the management interface reachable from the internet is exposed; these models are commonly deployed as small-business and branch-office VPN gateways. The flaw is being actively exploited: CISA added it to the KEV on 2021-11-03 and EPSS assigns a 100% probability of exploitation within 30 days, though no public PoC is catalogued.
What to do: Upgrade Vigor3900, Vigor2960, and Vigor300B to firmware 1.5.1.1 or later per DrayTek's instructions, as required by the CISA KEV entry. Do not expose the web management page directly to the internet, and inspect internet-facing units for indicators of compromise such as unexpected web shell files (e.g., webs.php), unknown administrator accounts, or altered firewall/VPN settings. If compromise is confirmed, perform a factory reset and reflash clean firmware, then restore configurations from trusted backups.
Affected
| DrayTek Vigor3900 | firmware prior to the vendor fix (v1.5.1.1 per DrayTek's advisory); CISA lists 'Multiple Vigor Routers' |
| DrayTek Vigor2960 | firmware prior to the vendor fix (v1.5.1.1 per DrayTek's advisory) |
| DrayTek Vigor300B | firmware prior to the vendor fix (v1.5.1.1 per DrayTek's advisory) |
Estimated exposure
large≈10,000–100,000 internet-exposed Vigor routers (total Vigor installed base in the millions) — DrayTek Vigor routers are widely deployed as small-business/branch VPN gateways, and public internet-wide scans have repeatedly shown tens of thousands of exposed DrayTek web management interfaces, of which the Vigor3900/2960/300B business…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
CISA Known Exploited Vulnerability
- Affected
- DrayTek Multiple Vigor Routers
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- draytek
- Products
- vigor2960 firmware, vigor300b firmware, vigor3900 firmware
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news13 stories
CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices
60
60
60
60
60
60
60
60
60
60
47
Mirai Variant V3G4 Targets IoT Devices
Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.
From July to December 2022, Unit 42 observed three campaigns spreading V3G4, a Mirai botnet variant, by exploiting 13 vulnerabilities, including CVE-2022-26134 in Atlassian Confluence and CVE-2019-15107 in Webmin. The campaigns shared the same C2 domains containing the string 8xl9, nearly identical shell script downloaders, and the same XOR keys, suggesting a single threat actor. The malware brute-forces telnet and SSH credentials, terminates rival botnet processes via a stop list, and receives DDoS commands from its C2. Compromised servers and networking devices are absorbed into the botnet for further attacks.
45