Critical OS Command Injection in DrayTek Vigor Routers (CVE‑2020‑15415) Enables Remote Code Execution
What It Is – The CVE‑2020‑15415 flaw is an OS command‑injection bug in the cgi-bin/mainfunction.cgi/cvmcfgupload endpoint of DrayTek Vigor 3900, 2960 and 300B routers. Supplying a crafted filename with the text/x-python-script content‑type injects shell metacharacters, allowing an unauthenticated attacker to execute arbitrary commands on the device.
Exploitability – Public PoC scripts exist; the vulnerability is exploitable over the network without authentication. The NVD rates it CVSS 3.1 9.8 (Critical).
Affected Products – DrayTek Vigor 3900, Vigor 2960, Vigor 300B (all firmware versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Patch‑management evidence – Demonstrating that firmware is up‑to‑date provides concrete audit evidence of a core “maintain secure configurations” control.
- Continuous device monitoring – Logging of firmware versions and anomalous CGI calls feeds a continuous‑monitoring pipeline that can be presented as defensible proof of due‑diligence.
- Supply‑chain oversight – The router is a third‑party component; maintaining an inventory and verification process satisfies a cross‑framework control on vendor‑risk oversight.
Recommended Actions
- Inventory all DrayTek Vigor devices and record firmware versions.
- Apply the vendor‑released firmware patch (or upgrade to a version that disables the vulnerable CGI endpoint).
- Enable logging of CGI requests and monitor for suspicious filenames or content‑type headers.
- Incorporate the patch‑status check into your continuous compliance dashboard to retain audit‑ready evidence.
Source: CISA KEV – CVE‑2020‑15415