Known Exploited Vulnerabilities September 30, 2024 · CISA KEV Catalog

CVE-2020-15415: Dray Tek Multiple Vigor Routers OS Command Injection Vulnerability

DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2020-15415DrayTek

Related

CVE-2024-12987: Dray Tek Vigor Routers OS Command Injection Vulnerability Known Exploited Vulnerabilities · May 15, 2025

CVE-2021-20123: Draytek Vigor Connect Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 03, 2024

CVE-2021-20124: Draytek Vigor Connect Path Traversal Vulnerability Known Exploited Vulnerabilities · Sep 03, 2024