Unrated severityCISA KEVNVD Advisory· Published Jun 30, 2020· Updated Oct 21, 2025

CVE-2020-15415

Description

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

DrayTek/Vigor3900, Vigor2960, and Vigor300Bdescription
Draytek/Vigor 300Bllm-fuzzy
Range: <1.5.1
Draytek/Vigor2962llm-fuzzy
Range: <1.5.1
Draytek/Vigor3900llm-fuzzy
Range: <1.5.1

Patches

Vulnerability mechanics

References

www.draytek.com/about/security-advisorymitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.068
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000