7.5
Élevée
Exploitée
CVE-2021-20124 Draytek VigorConnect Path Traversal Vulnerability
Exploitation active constatée
· catalogue CISA KEV
Action attendue
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Campagnes de rançongiciel
Non constatée à ce jour
Faiblesse
CWE-22
Description
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Draytek VigorConnect | 1.6.0-B3 | Pas de correctif indiqué |
| vigorconnect | 1.6.0 | Pas de correctif indiqué |
Références
- www.tenable.com www.tenable.com
Chronologie
- Publiée
- Ajoutée au catalogue KEV
- Dernière modification
Autres CVE de Draytek VigorConnect
Les 7 CVE de Draytek VigorConnect →
CVE-2021-20129
An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to…
Non notée
CVE-2021-20128
The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable…
Non notée
CVE-2021-20127
An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek…
Non notée
CVE-2021-20126
Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a…
Non notée