PT-2021-8121 · Draytek · Draytek Vigorconnect

Derrie Sutton + 1 · Published 2021-10-13 · Updated 2025-04-02 · CVE-2021-20124

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Draytek VigorConnect version 1.6.0-B3

Description A local file inclusion vulnerability exists in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. The issue is related to incorrect restriction of the directory path name with limited access.

Recommendations For Draytek VigorConnect version 1.6.0-B3, as a temporary workaround, consider disabling the file download functionality of the WebServlet endpoint until a patch is available. Restrict access to the WebServlet endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-07875

CVE-2021-20124

Affected Products

Draytek Vigorconnect

References · 37

• 🔥 https://tenable.com/security/research/tra-2021-42 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20124 · Security Note
• https://draytek.com/about/security-advisory/vigorconnect-software-security-vulnerability-(cve-2021-20123-cve-2021-20129) · Security Note
• https://bdu.fstec.ru/vul/2024-07875 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-20124 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20124 · Vendor Advisory
• https://t.me/true_secator/6278 · Telegram Post
• https://vulners.com/vulnrichment/VULNRICHMENT:CVE-2021-20124 · Note
• https://twitter.com/CISACyber/status/1830983416696750445 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124 · Note
• https://twitter.com/CyberxtronTech/status/1831205209067925902 · Twitter Post
• https://twitter.com/wills_beard/status/1839334404310905204 · Twitter Post
• https://twitter.com/buaqbot/status/1833222656629325946 · Twitter Post
• https://twitter.com/inthewildio/status/1833012480081064357 · Twitter Post
• https://t.me/cvenotify/93317 · Telegram Post