Digest · Wednesday

Security digest: June 17, 2020

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: DrayTek Vigor CVE-2020-15415: Botnet-Exploited Router RCE. Anyone running a DrayTek Vigor3900, Vigor2960 or Vigor300B, especially with the web management interface reachable from the internet.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Jun 17, 2020 · Vulnerability · CVE-2020-15415

DrayTek Vigor CVE-2020-15415: Botnet-Exploited Router RCE

Patched in 2020 but still used by botnets, on routers DrayTek now lists as end of life or end of sale; find any Vigor3900, 2960 or 300B, keep its admin interface off the internet, and plan to replace it.

Must act: Anyone running a DrayTek Vigor3900, Vigor2960 or Vigor300B, especially with the web management interface reachable from the internet.

Can relax: Organizations with no Vigor3900, 2960 or 300B; other DrayTek models are not affected by this bug, per DrayTek.

Find every Vigor3900, Vigor2960 and Vigor300B, including in branch offices, and record its firmware version.
Replace Vigor3900 and Vigor300B units, which DrayTek lists as end of life, and schedule replacement of Vigor2960.
Until replaced, run firmware 1.5.1.5 or later.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.