DrayTek flaws being used in attacks

CISA lists 5 flaws in DrayTek products as being used in attacks, most recently on 15 May 2025.

What to do

1. Update every DrayTek product you use.Install the updates DrayTek offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 15 May 2025
   DrayTek Vigor Routers
   CVE-2024-12987DrayTek Vigor Routers OS Command Injection Vulnerability
   DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface.
   CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksAdded by CISA on 30 Sep 2024
   DrayTek Multiple Vigor Routers
   CVE-2020-15415DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
   DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksAdded by CISA on 3 Sep 2024
   DrayTek VigorConnect
   CVE-2021-20124Draytek VigorConnect Path Traversal Vulnerability
   Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksAdded by CISA on 3 Sep 2024
   DrayTek VigorConnect
   CVE-2021-20123Draytek VigorConnect Path Traversal Vulnerability
   Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
5. Being used in attacksAdded by CISA on 3 Nov 2021
   DrayTek Multiple Vigor Routers
   CVE-2020-8515Multiple DrayTek Vigor Routers Web Management Page Vulnerability
   DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. DrayTek on CISA’s site.