# CVE-2020-15415

On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharacters in a filename when the text/x-python-script content type is used, a different issue than CVE-2020-14472.

- Page: https://www.vulneraibility.com/cve/CVE-2020-15415
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2024-09-30; CISA due date 2024-10-21
- EPSS: 84.48%
- Detection templates only, no public exploit found: 1 Nuclei template
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2024-10-04)
- Weakness: CWE-78
- Published: 2020-06-30

## Affected

- draytek:vigor3900_firmware
- draytek:vigor2960_firmware
- draytek:vigor300b_firmware

## References

- [other] https://www.draytek.com/about/security-advisory
- [other] https://github.com/CLP-team/Vigor-Commond-Injection
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-15415

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.