Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2020-14472: On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.
CVE-2020-14472 · published 6 years ago
Summary
On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.
What to do
- Update draytek vigor300b_firmware to version 1.5.1.1 or later.
- Update draytek vigor2960_firmware to version 1.5.1.1 or later.
- Update draytek vigor3900_firmware to version 1.5.1.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| draytek | vigor300b_firmware |
< 1.5.1.1 cpe:2.3:o:draytek:vigor300b_firmware:*:*:*:*:*:*:*:* |
| draytek | vigor2960_firmware |
< 1.5.1.1 cpe:2.3:o:draytek:vigor2960_firmware:*:*:*:*:*:*:*:* |
| draytek | vigor3900_firmware |
< 1.5.1.1 cpe:2.3:o:draytek:vigor3900_firmware:*:*:*:*:*:*:*:* |
Original advisory text
On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.
On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file.
References
- https://gist.github.com/Cossack9989/fa9718434ceee4e6d4f6b0ad672c10f1 Exploit Third Party Advisory
- https://gist.github.com/WinMin/46165779215f1d47ec257210428c0240 Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-77Command Injection
Timeline
Published24 Jun 2020
Updated31 Oct 2026
First seen29 Sep 2026
Sources
CVE-2020-14472 · NVD
Track software like this
Free during beta