VYPR
← All advisories
Critical severity9.8CISA KEVNVD Advisory· Published Feb 1, 2020· Updated Jun 17, 2026

CVE-2020-8515

CVE-2020-8515

Description

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • Draytek/Vigor2960 Firmware
    cpe:2.3:o:draytek:vigor2960_firmware:1.3.1:beta:*:*:*:*:*:*
  • Draytek/Vigor300b Firmware3 versions
    cpe:2.3:o:draytek:vigor300b_firmware:1.3.3:beta:*:*:*:*:*:*+ 2 more
    • cpe:2.3:o:draytek:vigor300b_firmware:1.3.3:beta:*:*:*:*:*:*
    • cpe:2.3:o:draytek:vigor300b_firmware:1.4.2.1:beta:*:*:*:*:*:*
    • cpe:2.3:o:draytek:vigor300b_firmware:1.4.4:beta:*:*:*:*:*:*
  • Draytek/Vigor3900 Firmware
    cpe:2.3:o:draytek:vigor3900_firmware:1.4.4:beta:*:*:*:*:*:*
  • DrayTek/Vigor2960description
  • Draytek/Vigor 300Bllm-fuzzy
    Range: <1.3.3_Beta, <1.4.2.1_Beta, <1.4.4_Beta
  • Draytek/Vigor2962llm-fuzzy
    Range: <1.3.1_Beta
  • Draytek/Vigor3900llm-fuzzy
    Range: <1.4.4_Beta

Patches

Vulnerability mechanics

References

4

News mentions

2