https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415 DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Added to the CISA KEV catalog on 2024-09-30. CVE-2020-15415 was assigned before 2024; the KEV listing came in 2024. en Mon, 30 Sep 2024 00:00:00 GMT https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415 https://pwn.watch/i/draytek-multiple-vigor-routers-cve-2020-15415#2024-09-30-13b02a8e Mon, 30 Sep 2024 00:00:00 GMT critical <p><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Source</a></p>