CVE-2020-15415 DrayTek Multiple Vigor Routers
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
- CVSS
- not scored
On CISA’s exploited list
DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
- Added
- 2024-09-30
- Federal patch deadline
- 2024-10-21
- Ransomware use
- not known