CVE-2020-8515VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability

Affects DrayTek Multiple Vigor RoutersSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-8515 (opens in a new tab)

Description

Multiple DrayTek Vigor routers, including models Vigor3900, Vigor2960, and Vigor300B, have a vulnerability in their web management interface that allows remote code execution. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2020-8515 is a remote code execution vulnerability affecting DrayTek Vigor3900, Vigor2960, and Vigor300B routers via their web management pages. The exact technical details of the vulnerability are unspecified, but it is associated with CWE-78 (OS Command Injection). Exploitation allows attackers to execute arbitrary code remotely on the affected devices. The vulnerability has been observed in active exploitation campaigns.

Impact

Successful exploitation of this vulnerability enables remote attackers to execute arbitrary code on the affected routers, potentially leading to full device compromise. This can disrupt network operations, allow unauthorized access, and facilitate further attacks within the network environment.

Mitigation

No patch or remediation information is provided in the available data. Users should consult DrayTek's official advisories for updates and apply any available firmware updates promptly. Until a fix is confirmed, restricting access to the web management interface and employing network-level protections may reduce exposure.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:56 UTC

Weaknesses

References

Related threats