CVE-2021-20123

HIGHCISA KEV

7.5

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Details CVE

Score CVSS v3.17.5

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/13/2021

Derniere modification11/3/2025

Sourcekev

Observations honeypot0

CISA KEV

FournisseurDrayTek

ProduitVigorConnect

Nom vulnerabiliteDraytek VigorConnect Path Traversal Vulnerability

Date ajout KEV2024-09-03

Date limite remediation2024-09-24

Utilise dans ransomwareUnknown

Produits affectes

draytek:vigorconnect

Faiblesses (CWE)

CWE-22CWE-22

References

https://www.tenable.com/security/research/tra-2021-42(vulnreport@tenable.com)

https://www.tenable.com/security/research/tra-2021-42(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.