DrayTek - RCE (CVE-2020-15415)
Description
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.
psychologyCrowdSec Analysis
CVE-2020-15415 is a remote command execution vulnerability affecting several DrayTek Vigor network devices, allowing unauthenticated attackers to execute arbitrary commands by leveraging improper input handling in a specific upload endpoint.
CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-15415 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2020-15415 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Exploitation attempts are identifiable by requests to URLs containing /cgi-bin/mainfunction.cgi/cvmcfgupload.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2020-06-30 |
| CISA KEV | 2024-09-30 |
| CISA Remediation Deadline | 2024-10-21 |
| Rule Released | 2025-05-28 |
| CrowdSec First Seen | 2025-05-28 |