Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2020-14472

31
FAUCET Score

CVE-2020-14472 describes critical command injection vulnerabilities in the mainfunction.cgi file of Draytek Vigor3900, Vigor2960, and Vigor 300B devices running firmware versions prior to 1.5.1.1. With a CVSS score of 9.8, this vulnerability allows unauthenticated attackers to execute arbitrary commands remotely with high impact on confidentiality, integrity, and availability. While the vulnerability is severe, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 1.5.1.1CPE matchmatch criteria
cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:*
< 1.5.1.1CPE matchmatch criteria
cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:*
< 1.5.1.1CPE matchmatch criteria
cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.93%
Probability of exploitation in next 30 days
EPSS Percentile
85.6%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0293 is in the 77th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (7)

capnprotovendor investigatingvia llm_extracted
View patch
ciscovendor investigatingvia llm_extracted
View patch
hedgedocvendor investigatingvia llm_extracted
View patch
hpvendor investigatingvia llm_extracted
View patch
jenkinsvendor investigatingvia llm_extracted
View patch
lycheeorgvendor investigatingvia llm_extracted
View patch
yokogawavendor investigatingvia llm_extracted
View patch

Vendor Advisories (7)

yokogawallm-yokogawa-fcc039d6f23d21b1

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
lycheeorgllm-lycheeorg-7d591aa0b6533109

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
jenkinsllm-jenkins-b45b34f1da17b8c8

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
hpllm-hp-ebc9c75b553ef2d3

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
hedgedocllm-hedgedoc-870ee850ab111b4a

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
capnprotollm-capnproto-4a4ac409002c2405

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020
ciscollm-cisco-ca5282227b0b85a4

Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415)

Jun 24, 2020

References

gist.github.com / Cossack9989/fa9718434ceee4e6d4f6b0ad672c10f1
ExploitThird Party Advisory
gist.github.com / WinMin/46165779215f1d47ec257210428c0240
ExploitThird Party Advisory