Is CVE-2020-15415 (DrayTek Multiple Vigor Routers OS Command Injection) being exploited in the wild?

Yes. CISA added CVE-2020-15415 to its Known Exploited Vulnerabilities catalogue on 30 September 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.

What “being exploited in the wild” means for this CVE

For a router flaw, the important distinction is between a theoretical vulnerability and one that is already being used against real devices. KEV inclusion means defenders should treat the issue as actively exploitable, not just as a patch-management item. That usually shifts the question from “should we track it?” to “are we exposed right now?”

For internet-facing appliances, exploitation risk is often highest where management interfaces, upload handlers, or other non-obvious functions remain reachable from untrusted networks. Even when a device is not serving users directly, it can still be a high-value entry point because compromise can expose routing, remote administration, and downstream internal access paths.

DrayTek router issues of this kind should therefore be handled as edge-device exposure problems, not just software defects. The operational question is whether the vulnerable function is reachable, whether the device is managed locally or remotely, and whether compromise of the box would create a foothold into more trusted network segments.

How to confirm exposure and reduce attack surface

Start by identifying every affected model and checking whether any instance is reachable from the internet or from broadly trusted internal networks. For edge devices, exposure often comes from management services, VPN access paths, or legacy admin interfaces that were left enabled for convenience.

If the device is in scope, follow the vendor advisory for the exact fix or mitigation and use the CISA Known Exploited Vulnerabilities Catalog as the prioritisation trigger. The practical goal is to remove reachable attack surface before an attacker reaches the vulnerable code path. Where possible, restrict management access to trusted administrative networks only.

When patching is not immediately possible, the next best control is containment. Reduce exposure by disabling unnecessary services, limiting who can reach the device, and monitoring for unusual requests to administrative or upload-related endpoints. For public-facing appliances, even a small configuration gap can be enough for exploitation.

What to check if the router may already be compromised

When a router vulnerability is confirmed active in the wild, patching alone is not enough if there is a plausible window for prior compromise. Check for unexpected configuration changes, unknown administrator accounts, altered DNS or routing settings, unusual outbound connections, and logs that show access to administrative functions from unfamiliar sources.

If the device provides shell-like functionality or supports stored credentials, assume the attacker may have obtained configuration data or used the box as a staging point. Look for lateral movement indicators on adjacent systems, because edge-device compromise is often valuable precisely because it can be used to pivot deeper into the environment.

If you find signs of tampering, treat the router as a likely trust boundary failure. Rebuild or factory-reset the appliance where feasible, restore only known-good configuration, and verify that any credentials, VPN secrets, or administrative tokens associated with the device have been rotated.

Risk and Threat Considerations

Actively exploited router flaws matter because they sit at the boundary between the internet and the internal network. That makes them attractive for attackers seeking remote code execution, persistence, and a durable foothold with minimal user interaction.

Failure mechanism: An attacker reaches the vulnerable handler, supplies crafted input that is processed as a command, and uses the device’s privileged network position to execute code or alter configuration before defenders notice.

Impact: The result can include remote administration takeover, traffic interception, credential exposure, and downstream access to internal systems that trust the router or the network segment behind it.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	CVE exploitation requires prompt remediation of known flaws.
	AC-4 — Information Flow Enforcement	Router compromise can be reduced by limiting who can reach management paths.
Recommendation — Prioritise remediation for actively exploited router flaws and verify the fix on all exposed assets. Restrict management and upload interfaces to trusted networks and administrative sources.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed issues need rapid identification and remediation across exposed devices.
	CIS-12 — Network Infrastructure Management	Router security depends on controlling edge-device configuration and management access.
Recommendation — Track edge-device exposure continuously and accelerate remediation for exploited vulnerabilities. Harden router management paths, remove unnecessary services, and validate network device configurations.
NIST CSF 2.0	PR.PS-01 — Identity Management, Authentication and Access Control	Router admin surfaces must be limited to prevent abuse of privileged access paths.
Recommendation — Enforce access restrictions on administrative interfaces and review exposed management services.

Practitioner Guidance

What to prioritise: Prioritise externally reachable routers first, then any internal appliances that provide management or upload functionality to wide trust zones. If the device can be reached from untrusted networks, treat it as urgent even before you finish broader vulnerability backlogs.

What to verify: Verify not only that the vendor fix is applied, but also that the vulnerable interface is no longer exposed in practice. Configuration drift, alternate admin paths, and forgotten remote-management rules are common reasons a “patched” router still remains exploitable.

Decision rule: If there is any evidence that the router was reachable before remediation, perform compromise assessment before you declare the incident closed. For edge devices, the cost of assuming clean status is usually higher than the cost of checking for tampering.

Practitioner takeaway: For KEV-listed router vulnerabilities, exposure control and compromise assessment are part of the same response, because a device that sits on the network edge can be both the initial entry point and the persistence mechanism.