DrayTek - RCE (CVE-2020-15415)

CVE-2020-15415 is a remote command execution vulnerability affecting several DrayTek Vigor network devices, allowing unauthenticated attackers to execute arbitrary commands by leveraging improper input handling in a specific upload endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-15415 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2020-15415 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2020-15415 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Exploitation attempts are identifiable by requests to URLs containing /cgi-bin/mainfunction.cgi/cvmcfgupload.