Critical severity9.8CISA KEVNVD Advisory· Published Jun 30, 2020· Updated Jun 17, 2026

CVE-2020-15415

Description

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Draytek/Vigor2960 Firmware
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1
Draytek/Vigor300b Firmware
cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1
Draytek/Vigor3900 Firmware
cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:*
Range: <1.5.1
DrayTek/Vigor3900, Vigor2960, and Vigor300Bdescription
Draytek/Vigor 300Bllm-fuzzy
Range: <1.5.1
Draytek/Vigor2962llm-fuzzy
Range: <1.5.1
Draytek/Vigor3900llm-fuzzy
Range: <1.5.1

Patches

Vulnerability mechanics

References

www.draytek.com/about/security-advisorynvdVendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.068
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000