ACTIVELY EXPLOITED
CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability
| Vendor | DrayTek |
|---|---|
| Product | Multiple Vigor Routers |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
SOURCES
Other DrayTek flaws
- CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability
- CVE-2020-15415: DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
- CVE-2021-20124: Draytek VigorConnect Path Traversal Vulnerability
- CVE-2021-20123: Draytek VigorConnect Path Traversal Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.