CVE-2021-20123

HIGHCISA KEV

7.5

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/13/2021

Last Modified11/3/2025

Sourcekev

Honeypot Sightings0

CISA KEV

VendorDrayTek

ProductVigorConnect

Vulnerability NameDraytek VigorConnect Path Traversal Vulnerability

KEV Date Added2024-09-03

Remediation Due Date2024-09-24

Ransomware UseUnknown

Affected Products

draytek:vigorconnect

Weaknesses (CWE)

CWE-22CWE-22

References

https://www.tenable.com/security/research/tra-2021-42(vulnreport@tenable.com)

https://www.tenable.com/security/research/tra-2021-42(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.