DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.
Is CVE-2020-8515 exploited?
Listed in the CISA KEV catalog on 2021-11-03.
Federal remediation due 2022-05-03.
Past that date by 1565 days.
EPSS puts exploitation in the next 30 days at 100.0%.
Public exploit code: proof of concept.
Public detection rules exist.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2020-8515
PlainSec has not published a story about this CVE.