Not rated
CVE-2021-20125 An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of…
Description
An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Draytek VigorConnect | 1.6.0-B3 | No fix stated |
References
- www.tenable.com www.tenable.com
Timeline
- Published
- Last modified
Other CVEs of Draytek VigorConnect
The 7 CVEs of Draytek VigorConnect →
CVE-2021-20129
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to…
Not rated
CVE-2021-20128
The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable…
Not rated
CVE-2021-20127
An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek…
Not rated
CVE-2021-20126
Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a…
Not rated