CVE-2020-15415

FAUCET Score

CVE-2020-15415 is a critical OS command injection vulnerability affecting DrayTek Vigor3900, Vigor2960, and Vigor300B devices before firmware version 1.5.1. This flaw allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into a filename when uploading a file with the text/x-python-script content type to cgi-bin/mainfunction.cgi/cvmcfgupload. With a CVSS score of 9.8 (Critical) and an EPSS score indicating it's more exploitable than 99.7% of all CVEs, this vulnerability poses a severe risk, enabling full compromise of affected devices. It is actively exploited in the wild, notably by Mirai botnet variants, and has garnered significant community discussion and media coverage, with Nuclei templates available for detection.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		< 1.5.1CPE matchmatch criteria	cpe:2.3:o:draytek:vigor3900_firmware::::::::
		< 1.5.1CPE matchmatch criteria	cpe:2.3:o:draytek:vigor2960_firmware::::::::
		< 1.5.1CPE matchmatch criteria	cpe:2.3:o:draytek:vigor300b_firmware::::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

84.60%

Probability of exploitation in next 30 days

EPSS Percentile

99.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

Added to KEV · Sep 30, 2024

Nuclei: CVE-2020-15415 · May 19, 2025

This CVE's current EPSS score of 0.8460 is in the 99th percentile among its peer group of 36,862 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (7)

capnprotovendor investigatingvia llm_extracted

View patch

ciscovendor investigatingvia llm_extracted

View patch

hedgedocvendor investigatingvia llm_extracted

View patch

hpvendor investigatingvia llm_extracted

View patch

jenkinsvendor investigatingvia llm_extracted

View patch

lycheeorgvendor investigatingvia llm_extracted

View patch

yokogawavendor investigatingvia llm_extracted

View patch