CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability

CVE-2020-8515 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2021-11-03

DrayTek Vigor2960, Vigor3900, and Vigor300B routers are vulnerable to unauthenticated remote code execution as root. The flaw exists in the cgi-bin/mainfunction.cgi URI due to improper neutralization of shell metacharacters.

Vendors: DrayTek.

Quick answers

Is CVE-2020-8515 exploited in the wild?
Yes. CVE-2020-8515 is known to be exploited in the wild, first recorded on 3 November 2021. Treat it as urgent.
How severe is CVE-2020-8515?
Critical severity, with a CVSS score of 9.8, published 3 November 2021.
Which products and versions are affected?
DrayTek Vigor2960 1.3.1_Beta; DrayTek Vigor3900 1.4.4_Beta; DrayTek Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, 1.4.4_Beta.
Is there a fix for CVE-2020-8515?
A patch was published on 2020-02-10: Fixed in firmware version 1.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-8515 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2020-8515?
Check whether you run DrayTek Multiple Vigor Routers. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

  • DrayTek Vigor2960 1.3.1_Beta
  • DrayTek Vigor3900 1.4.4_Beta
  • DrayTek Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, 1.4.4_Beta

Timeline

  • 2020-01-28: disclosed: Initial third-party disclosure via blog post
  • 2021-11-03: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2020-02-10: patched: Fixed in firmware version 1.5.1

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.