CVE-2021-20123VulnerabilityPublished 09/03/2024Updated 10/24/2026
CVE-2021-20123: Draytek VigorConnect Path Traversal Vulnerability
Affects DrayTek VigorConnectSource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 09/03/2024
- KEV deadline
- 09/24/2024
- EPSS
- 90.2% chance of exploitation in 30 days – higher than 99% of CVEs
What to do
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.