CVE-2020-19664

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/minghangshen/bug_pocExploit, Third Party Advisory
https://nosec.org/home/detail/4631.htmlExploit, Third Party Advisory
https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-%28cve-2020-19664%29/
https://github.com/minghangshen/bug_pocExploit, Third Party Advisory
https://nosec.org/home/detail/4631.htmlExploit, Third Party Advisory
https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-%28cve-2020-19664%29/

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-196677.8Stack-based buffer overflow and unconditional jump in ReadXPMImage in coders/xpm.c in ImageMagick 7.0.10-7.CVE-2020-196686.5Unverified indexs into the array lead to out of bound access in the gif_out_code function in fromgif.c in libsixel 1.8.6.CVE-2020-196698.8Cross Site Request Forgery (CSRF) vulnerability exists in Eyoucms 1.3.6 that can add an admin account via /login.php?m=admin&c=Admin&a=admin CVE-2020-19677.5Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer d CVE-2020-196704.9In Niushop B2B2C Multi-Business Basic Edition V1.11, authentication can be bypassed, causing administrators to reset any passwords.CVE-2020-196729.8Niushop B2B2C Multi-business basic version V1.11, can bypass the administrator to obtain the background upload interface, through parameter CVE-2020-196765.3Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other CVE-2020-196787.5Directory Traversal vulnerability found in Pfsense v.2.1.3 and Pfsense Suricata v.1.4.6 pkg v.1.0.1 allows a remote attacker to obtain sensi CVE-2020-19683.7The Raccoon attack exploits a flaw in the TLS specification which can lead to an attacker being able to compute the pre-master secret in con CVE-2020-196828.8A Cross Site Request Forgery (CSRF) vulnerability exits in ZZZCMS V1.7.1 via the save_user funciton in save.php.CVE-2020-196835.4A Cross Site Scripting (XSS) exists in ZZZCMS V1.7.1 via an editfile action in save.php.CVE-2020-196929.8Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the