erroneo.us
Search all guides⌘K

Security Digest · Jun 17, 2020 · Vulnerability · Network edge

DrayTek Vigor CVE-2020-15415: Botnet-Exploited Router RCE

A 2020 unauthenticated RCE in DrayTek Vigor3900, 2960 and 300B (fixed in 1.5.1.1) is used by Mirai and PRC-linked botnets. Most are now EOL: replace them.

Published By erroneo.us Security Desk · Updated 3 min read12 sources

Our verdict

Check exposure

Patched in 2020 but still used by botnets, on routers DrayTek now lists as end of life or end of sale; find any Vigor3900, 2960 or 300B, keep its admin interface off the internet, and plan to replace it.

Who must act: Anyone running a DrayTek Vigor3900, Vigor2960 or Vigor300B, especially with the web management interface reachable from the internet.

Who can relax: Organizations with no Vigor3900, 2960 or 300B; other DrayTek models are not affected by this bug, per DrayTek.

Affected
DrayTek Vigor3900, Vigor2960 and Vigor300B with firmware before 1.5.1.1 (the CVE record says before 1.5.1)
Fixed in
Firmware 1.5.1.1 for all three models (Jun 17, 2020)
Today: 1.5.1.5 or later, which also fixes the exploited CVE-2024-12987
Vigor3900 and Vigor300B are end of life and Vigor2960 is end of sale, so replacement is the durable fix
CVSS
9.8 (v3.1, NVD)
EPSS
84.5% (percentile 99.7)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every Vigor3900, Vigor2960 and Vigor300B, including in branch offices, and record its firmware version.
  2. Replace Vigor3900 and Vigor300B units, which DrayTek lists as end of life, and schedule replacement of Vigor2960.
  3. Until replaced, run firmware 1.5.1.5 or later.
  4. Block internet access to the web management interface; allow it only from a management network or VPN.
  5. If a unit ran old firmware with management exposed, reflash or replace it and change every password and VPN secret it holds.

How to check if you are affected or compromised

  • If you log traffic to the router's admin interface, look for POSTs to /cgi-bin/mainfunction.cgi/cvmcfgupload or /cgi-bin/mainfunction.cgi/apmcfgupload from outside your admin network.
  • Check DNS and firewall logs for router traffic to w8510.com subdomains, the botnet C2 domain in the September 2024 joint advisory.
  • Watch for router requests to c.speedtest.net and unexplained outbound TLS on 443, behavior the advisory describes for the botnet malware.
  • Review the router for unknown admin accounts, VPN profiles or changed DNS settings.

What happened#

In April 2020, researchers reported a command injection bug in three DrayTek business routers: the Vigor3900, Vigor2960 and Vigor300B. DrayTek's advisory, released June 24, 2020, says it learned of "a possible exploit" on April 12 and released fixed firmware 1.5.1.1 on June 17, 2020. It credits researchers from Chaitin Security Research Lab and Nanjing University of Posts and Telecommunications. The original report, with a proof of concept, is public on GitHub.

The CVE record describes the bug. The web interface's /cgi-bin/mainfunction.cgi/cvmcfgupload handler runs shell metacharacters placed in an uploaded file's name when the request uses the text/x-python-script content type. No login is needed. NVD scores it CVSS 3.1 9.8. DrayTek's advisory covers it together with a sibling bug, CVE-2020-14472.

Botnets picked it up. Unit 42 reported in February 2023 that the Mirai variant V3G4 used it among 13 exploits between July and December 2022. On September 18, 2024, the FBI, Cyber National Mission Force and NSA published a joint advisory on a Mirai-based botnet run by Integrity Technology Group. The agencies call it a PRC-based company and link its activity to the group known as Flax Typhoon. The botnet had over 260,000 devices as of June 2024. Its appendix of CVEs "exploited to add devices to botnet" lists CVE-2020-15415 with two other DrayTek bugs. Twelve days later, on September 30, 2024, CISA added the CVE to KEV. CISA did not cite its evidence, but the botnet reports explain why a 2020 bug was listed in 2024.

Who is affected#

Vigor3900, Vigor2960 and Vigor300B on firmware older than 1.5.1.1. DrayTek says no other models are affected. Its lifecycle page lists the Vigor3900 and Vigor300B as end of life and the Vigor2960 as end of sale.

Do you really need to act?#

Only if you own one of these models, and then mostly to replace it. A unit patched in 2020 is not safe by default. The same models have kept getting exploited bugs in the same CGI handler family. CVE-2024-12987, a command injection in apmcfgupload, joined KEV in May 2025 and is fixed in 1.5.1.5. DrayTek marks that release "Critical - Upgrade immediately." On hardware that is end of life, the next bug may get no fix at all. Exposure is the key factor. Botnets scan for internet-reachable admin interfaces, so a router managed only from inside is far less likely to be hit.

What to do now#

  1. Find every Vigor3900, 2960 and 300B, including in branch offices, and record its firmware version.
  2. Replace end-of-life units. Until then, run 1.5.1.5 or later.
  3. Block internet access to the web management interface and allow it only from a management network or VPN.
  4. If a unit ran old firmware with management exposed, reflash or replace it and change every password and VPN secret it holds.

How to tell if you were hit#

  • If you log traffic to the router's admin interface, look for POSTs to /cgi-bin/mainfunction.cgi/cvmcfgupload or apmcfgupload from outside your admin network.
  • Check DNS logs for router lookups of w8510.com subdomains, the botnet's C2 domain, and of c.speedtest.net, which the malware queries.
  • Review the router for unknown admin accounts, VPN profiles or changed DNS settings.

Timeline#

  • — DrayTek learns of a possible exploit.
  • — Firmware 1.5.1.1 released.
  • — DrayTek publishes its advisory.
  • — Unit 42 reports V3G4 Mirai exploiting the bug in 2022.
  • — Joint advisory lists it among the Integrity Tech botnet's exploits.
  • — CISA adds CVE-2020-15415 to KEV; federal deadline Oct 21, 2024.
  • — CVE-2024-12987 on the same models added to KEV.

Vulnerability records

  • CVE-2020-15415 · KEV 2024-09-30 · On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. DrayTek — Vigor3900 / Vigor2960 / Vigor300B Remote code injection/execution Vulnerability (CVE-2020-14472 / CVE-2020-15415) (archived copy) web.archive.org
  2. CLP-team — Vigor-Commond-Injection (original report and proof of concept) github.com
  3. CVE record — CVE-2020-15415 cve.org
  4. NVD — CVE-2020-15415 nvd.nist.gov
  5. CISA — Known Exploited Vulnerabilities: CVE-2020-15415 cisa.gov
  6. CISA — CISA Adds Four Known Exploited Vulnerabilities to Catalog (Sep 30, 2024) cisa.gov
  7. FBI, CNMF and NSA — JCSA-20240918-001: People's Republic of China-Linked Actors Compromise Routers and IoT Devices for Botnet Operations ic3.gov
  8. Palo Alto Networks Unit 42 — Mirai Variant V3G4 Targets 13 Vulnerabilities to Spread unit42.paloaltonetworks.com
  9. DrayTek — Product Lifecycle (archived Sep 3, 2026) web.archive.org
  10. DrayTek — Vigor2960 firmware 1.5.1.5 release note fw.draytek.com.tw
  11. CVE record — CVE-2024-12987 cve.org
  12. CISA — Known Exploited Vulnerabilities: CVE-2024-12987 cisa.gov