7.5 High Exploited

CVE-2021-20123 Draytek VigorConnect Path Traversal Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware campaigns Not observed so far

Weakness CWE-22

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Affected products and versions

Product	Affected versions	Fixed in
Draytek VigorConnect	1.6.0-B3	No fix stated
vigorconnect	1.6.0	No fix stated

References

www.tenable.com www.tenable.com

Timeline

Published October 13, 2021
Added to the KEV catalogue September 3, 2024
Last modified October 21, 2025

The 7 CVEs of Draytek VigorConnect →

CVE-2021-20129 An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to… Not rated CVE-2021-20128 The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable… Not rated CVE-2021-20127 An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek… Not rated CVE-2021-20126 Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a… Not rated

Track this CVE