Improper Neutralization of Special Elements in Output Used by a Downstream Component in DrayTek Corp. products - CVE-2020-8515
Published: February 14, 2020 / Updated: September 14, 2022
Vulnerability identifier: #VU25350
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8515
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the affected devices allow remote code execution as root (without authentication) via shell metacharacters to the "cgi-bin/mainfunction.cgi" URI.
Note, this vulnerability is being actively exploited in the wild starting from December 4, 2019.
Affected software
Vigor 2960
Vigor 300B
Vigor 3900
Vigor 300B
Vigor 3900
How to mitigate CVE-2020-8515
Install updates from vendor's website.
Vigor 2960 - update to 1.5.1
Vigor 300B - update to 1.5.1
Vigor 3900 - update to 1.5.1
Vigor 300B - update to 1.5.1
Vigor 3900 - update to 1.5.1
Links to Public Exploits and PoC-codes
- Exploit #8367 - CVE-2020-8515 () (September 14, 2022)
- Exploit #8366 - CVE-2020-8515-PoC () (September 14, 2022)
- Exploit #6688 - CVE-2020-8515 (Draytek CVE-2020-8515 PoC) (September 2, 2021)
- Exploit #5734 - Multiple DrayTek Products - Pre-authentication Remote Root Code Execution (June 17, 2021)
- Exploit #2910 - nmap_draytek_rce (nmap script to detect CVE-2020-8515 on Draytek Devices) (June 3, 2020)
- Exploit #2893 - CVE-2020-8515-PoC (CVE-2020-8515-PoC) (June 3, 2020)
- Exploit #2576 - DrayTek Vigor2960 / Vigor3900 / Vigor300B Remote Command Execution (April 13, 2020)
External References
- https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html
- https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)/
- https://blog.netlab.360.com/two-zero-days-are-targeting-draytek-broadband-cpe-devices-en/