CVE-2021-20124: Draytek VigorConnect Path Traversal Vulnerability

Vulnerability summary

CVE-2021-20124 is a high (CVSS 7.8) Path Traversal vulnerability in DrayTek VigorConnect. It is known to be exploited: CISA lists it, first on 03-09-2024. EPSS estimates a 96.31% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 13-10-2021
   PublishedVulnerability first disclosed.
2. 03-09-2024
   Added to CISA KEVExploitedDraytek VigorConnect Path Traversal Vulnerability
3. 24-09-2024
   CISA remediation dueDeadline passedApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.