DrayTek - RCE (CVE-2020-15415)

CVE-2020-15415 is a remote command execution vulnerability affecting several DrayTek Vigor network devices, allowing unauthenticated attackers to execute arbitrary commands by leveraging improper input handling in a specific upload endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 28th of May 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2020-15415 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2020-15415 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2020-15415 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are identifiable by requests to URLs containing /cgi-bin/mainfunction.cgi/cvmcfgupload.