ZeroDay Findings
Sign inSign up

Findings

CVE-2021-20123

Draytek VigorConnect Path Traversal Vulnerability

Published Oct 13, 2021 · updated Jun 16, 2026 · draytek vigorconnect

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 13, 2021 · Catalog

    Detected

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

  2. Sep 3, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Sep 24, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Sep 24, 2024

Affected

  • cpe draytek/vigorconnect1.6.0
  • vendor DrayTek VigorConnectversion unspecified

Sources

  • CISA KEVCVE-2021-20123

    Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

    cisa.gov
  • CVE.orgCVE-2021-20123

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-20123

    30-day exploitation probability 90.2%

    first.org
  • NIST NVDCVE-2021-20123

    A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with

    nvd.nist.gov

References