cve recordhighexploited in the wild3 of 3 cataloguesexploit reported

CVE-2020-8515

DrayTek · Multiple Vigor Routers · Multiple DrayTek Vigor Routers Web Management Page Vulnerability

· Added to CISA KEV Nov 3, 2021

CVSS—

Severityhigh

Weakness—

EPSS100.0%100.0th percentile

Exploited3 KEV sources

Ransomware useUnknown

Federal fix dueMay 3, 2022

patch window

Called exploited 62 days after disclosure.

Measured from the CVE publication date to the earliest of 3 KEV catalogues that list it.

The life of this vulnerability

CVE publishedFeb 1, 2020
First KEV listingApr 3, 20202mo
Last KEV listingNov 3, 20211.6y
Last sightingSep 6, 20264.8y

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federallisted Nov 3, 2021
EUVDENISA, European Unionlisted Nov 3, 2021
VulnCheck KEVcommercial researchlisted Apr 3, 2020
CIRCLaggregator, mirrors the abovelisted Nov 3, 2021, not counted

Sources3 of 3

Listings differ by579 d

Strongest claimconfirmed

3 catalogues list it. CIRCL aggregates the others and is shown but not counted.

Public exploitation evidence

reported exploitationSep 6, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2020-8
reported exploitationSep 5, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2020-8
reported exploitationSep 4, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2020-8
reported exploitationSep 4, 2026dashboard.shadowserver.org/statistics/honeypot/vulnerability
reported exploitationSep 3, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2020-8
reported exploitationSep 2, 2026api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2020-8

987 public reports collected from VulnCheck and CIRCL, first on Apr 3, 2020. Each links to its original source. We have not verified them.

Description

DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution.

Required action (CISA)

Apply updates per vendor instructions.

References

← Back to the CVE Tracker

Our coverage of CVE-2020-8515

CVE-2008-4128Aug 7, 2026high

July 2026 CVE Landscape

Cybersecurity researchers identified 85 high-impact vulnerabilities in July 2026 that require urgent remediation, marking a 44% increase from the previous month. Of these, 36 were assigned a "Very Critical" risk score by Insikt Group. The vulnerabilities affected products from 61 vendors, with Microsoft accounting for approximately 12% of the total.