CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days.

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

Affected products

• DrayTek VIGOR2960 Firmware: version 1.3.1 only
• DrayTek VIGOR300B Firmware: version 1.3.3 only; version 1.4.2.1 only; version 1.4.4 only
• DrayTek VIGOR3900 Firmware: version 1.4.4 only

Published 2020-02-01. Last modified 2026-06-17.