CVE-2020-8515: DrayTek Vigor routers unauthenticated OS command injection in web management

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable root command execution with a 9.8 CVSS score, KEV listing and near-maximum EPSS probability.

What it is

DrayTek Vigor2960, Vigor3900 and Vigor300B firmware pass shell metacharacters to cgi-bin/mainfunction.cgi, allowing OS command injection. Because the flaw is reachable without authentication and executes as root, it is a full compromise of the router. The vendor fixed it in v1.5.1 for all three models.

Impact

An unauthenticated attacker gains remote code execution as root on the device, giving full control of the router, its configuration and any traffic or credentials it handles.

Attack surface

Reachable over the network through the web management interface at the cgi-bin/mainfunction.cgi URI; no authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV since 2021-11-03 and carrying an EPSS 30-day probability of 0.99993, with public exploit references tagged Exploit. No ransomware campaign use is documented in this record.

What to do

• Upgrade Vigor3900, Vigor2960 and Vigor300B to v1.5.1 or later as directed by the vendor advisory.
• Until patched, remove or restrict internet exposure of the router web management interface to trusted networks only.
• Block external access to cgi-bin/mainfunction.cgi at the perimeter and audit any prior exposure.
• Rotate credentials and inspect router configuration for unauthorized changes if the device was internet-facing.
• Monitor vendor and CISA guidance for this CVE and confirm remediation against the KEV due date.

Detection

• Review web server or proxy logs for requests to cgi-bin/mainfunction.cgi containing shell metacharacters.
• Alert on unexpected outbound connections or processes spawned by the router's web service.
• Compare router configuration against a known-good baseline to spot injected commands or new accounts.
• Search for known exploit payload strings from the public Packet Storm and blog references in network traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.