Vulnerability Intelligence Report
Draytek VigorConnect Path Traversal Vulnerability
CVE-2021-20123
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
Automatable
CVSS Base Score
7.5
HIGH
Exploitability:3.9
Impact Score:3.6
EPSS Probability:74.28%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-22 ↗CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| draytek | vigorconnect | 1.6.0 |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
74.279%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Tenable Network Security, Inc. · Vendor · USA |
| Reserved | 2020-12-17T00:00:00 |
| Published | 2021-10-13T15:47:58 |
| Last Updated | 2025-10-21T23:25:28 |
Community Chatter & Buzz