---
id: "CVE-2020-8515"
kind: "vulnerability"
aliases: ["CVE-2020-8515"]
title: "DrayTek Multiple Vigor Routers: Multiple DrayTek Vigor Routers Web Management Page Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99993
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "DrayTek Multiple Vigor Routers", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["draytek", "exploited", "infrastructure", "self-hosted", "vigor2960", "vigor300b", "vigor3900"]
not_affected_if: ["other-draytek-models", "web-management-disabled"]
published_at: "2020-02-01T13:15:12+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8515", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-8515", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8515", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# DrayTek Multiple Vigor Routers: Multiple DrayTek Vigor Routers Web Management Page Vulnerability

DrayTek Vigor3900, Vigor2960 and Vigor300B routers have an unspecified flaw in their web management page that allows remote code execution. CISA lists it as actively exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DrayTek Multiple Vigor Routers affected ? fixed ?

## Fix

Apply the vendor update for the affected Vigor model per CISA guidance; the specific firmware version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8515
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-8515
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-8515

## From the sources

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_