{"schemaVersion":3,"id":"CVE-2021-20124","aliases":[],"status":"published","duplicateOf":null,"title":"Draytek VigorConnect Path Traversal Vulnerability","description":"A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.","dates":{"published":"2021-10-13T15:48:03.000Z","modified":"2025-10-21T23:25:28.553Z","reserved":null,"kevAdded":["2024-09-03T00:00:00.000Z"],"kevDue":["2024-09-24T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.8,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.96308,"percentile":0.99882,"severity":"critical","asOf":"2026-10-22T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-22T00:00:00.000Z","baselineScore":0.96308},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.96308,"percentile":0.99882}],"last30":[{"date":"2026-09-22T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.96308,"percentile":null},{"date":"2026-10-22T00:00:00.000Z","score":0.96308,"percentile":0.99882}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-09-03T00:00:00.000Z","dueDate":"2024-09-24T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Draytek VigorConnect Path Traversal Vulnerability","description":"Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.","notes":[{"type":"url","href":"https://www.draytek.com/about/security-advisory/vigorconnect-software-security-vulnerability-(cve-2021-20123-cve-2021-20129)","label":"www.draytek.com/about/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-20124","label":"nvd.nist.gov/vuln/detail/CVE-2021-20124"}],"vendor":"DrayTek","product":"VigorConnect","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2024-09-03T00:00:00.000Z","dueDate":"2024-09-24T00:00:00.000Z","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","name":"Draytek VigorConnect Path Traversal Vulnerability","description":"Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.","notes":[{"type":"url","href":"https://www.draytek.com/about/security-advisory/vigorconnect-software-security-vulnerability-(cve-2021-20123-cve-2021-20129)","label":"www.draytek.com/about/…"},{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-20124","label":"nvd.nist.gov/vuln/detail/CVE-2021-20124"}],"vendor":"DrayTek","product":"VigorConnect","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_9D16FAE792E097F4","name":"Exploit Reference (tenable.com)","source":"reference","url":"https://www.tenable.com/security/research/tra-2021-42","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"draytek","product":"vigorconnect","name":"VigorConnect","label":"vigorconnect","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.6.0:beta3","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.6.0:beta3","eol":null,"hubHref":"/vendor/draytek/vigorconnect"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.tenable.com/security/research/tra-2021-42","label":"www.tenable.com/security/research/tra-2021-42","hostname":"www.tenable.com","tags":["X Refsource MISC","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2021-10-13T15:48:03.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2024-09-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Draytek VigorConnect Path Traversal Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2024-09-24T00:00:00.000Z","label":"CISA remediation due","detail":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:25:28.553Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T16:34:40.701Z","stale":false,"partial":false}}