CVE-2020-8515

What Are DrayTek Vigor Routers?

DrayTek's Vigor line includes business-class routers, VPN concentrators, and load-balancing gateways widely deployed by small and mid-sized businesses and by ISPs provisioning customer-premises equipment, particularly across Europe and Asia. The Vigor3900, Vigor2960, and Vigor300B models specifically target multi-WAN business connectivity and VPN aggregation — internet-facing by design, since their core function is terminating remote-access and site-to-site VPN connections.

Overview

CVE-2020-8515 is an OS command injection vulnerability (CWE-78) in the web management interface of the Vigor3900, Vigor2960, and Vigor300B models. An unauthenticated remote attacker can send a crafted request to the management interface that injects operating system commands, executing them with the router's system privileges (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical) — a single request is sufficient, with no login required.

Affected Versions

Technical Details

The flaw lies in how the web management CGI interface handles certain parameters in administrative requests, passing attacker-controlled input into a system-level command without adequate sanitization. Because these models are commonly deployed as internet-facing VPN gateways, exposure of the vulnerable interface to the internet is a common real-world configuration rather than an edge case — the routers' core function requires them to be reachable remotely.

Discovery

Publicly tracked via NVD; DrayTek routers, including these models, have been documented by network security researchers (including Taiwan's national CERT and regional threat-intelligence firms) as recurring targets of botnet scanning campaigns.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. DrayTek routers have historically been targeted by botnet operators seeking devices to recruit for DDoS and proxy infrastructure, given their business-grade bandwidth and common internet exposure as VPN/multi-WAN gateways — a more attractive target profile than typical consumer routers.

Remediation

1. Apply DrayTek's firmware update for your specific Vigor model immediately.
2. Restrict access to the web management interface to trusted internal management networks; disable remote/WAN-side management access if not strictly required.
3. Place management interfaces behind a VPN rather than exposing them directly, even on models whose core function is VPN termination — the data-plane VPN service and the management interface should not share the same exposure.
4. Check for signs of compromise — unexpected configuration changes, new admin accounts, or unusual outbound traffic — on any Vigor3900/2960/300B that has had its management interface internet-facing and unpatched.