{"id":"CVE-2021-20124","kind":"vulnerability","aliases":["CVE-2021-20124"],"related":[],"title":"A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of…","description":"Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"DrayTek VigorConnect, a management server for DrayTek routers and network gear, has a path traversal flaw in its WebServlet file download endpoint. An unauthenticated attacker can download arbitrary files from the underlying operating system with root privileges.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2024-09-03T00:00:00+00:00","products":[{"name":"DrayTek VigorConnect","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"draytek vigorconnect","fixed":[],"affected":"= 1.6.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["draytek","exploited","infrastructure","self-hosted","vigorconnect"],"not_affected_if":["no-vigorconnect-deployed"],"how_to_check":null,"fix":"Apply the mitigations from the vendor per CISA's required action, or stop using VigorConnect if no mitigation is available. The sources do not name a fixed version.","status":"open","published_at":"2021-10-13T16:15:07+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:15+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T20:58:15Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations from the vendor per CISA's required action, or stop using VigorConnect if no mitigation is available. The sources do not name a fixed version.","reach":"internet","impact":"high","summary":"DrayTek VigorConnect, a management server for DrayTek routers and network gear, has a path traversal flaw in its WebServlet file download endpoint. An unauthenticated attacker can download arbitrary files from the underlying operating system with root privileges.","category":"infrastructure","who_cares":["draytek","vigorconnect","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads any system file as root, including credentials and keys.","analyst_note":"Find the DrayTek advisory and the fixed VigorConnect version, and the exact WebServlet path to check logs for; sources give neither.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-vigorconnect-deployed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000471,"input_tokens":2848,"output_tokens":373,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-20124':19A,22A '-2021':18A,21A '1.6.0':10A 'action':108C 'appli':109C 'arbitrari':61B,96C 'attack':58B,89C 'b3':11A 'cisa':106C 'contain':73C 'could':90C 'cve':17A,20A 'discontinu':115C 'download':15A,54B,60B,81C,95C 'draytek':8A,23A,25A,27B,34B,40B,71C 'endpoint':55B,86C 'exist':6A 'exploit':28B 'file':3A,14A,53B,62B,80C,97C 'flaw':49B 'function':16A,82C 'gear':44B 'host':32B 'inclus':4A 'infrastructur':29B 'instruct':113C 'leverag':91C 'local':2A 'manag':37B 'mitig':110C,121C 'network':43B 'oper':66B,101C 'path':47B,75C 'per':111C 'privileg':70B,105C 'product':119C 'requir':107C 'root':69B,104C 'router':41B 'self':31B 'self-host':30B 'server':38B 'system':67B,102C 'travers':48B,76C 'unauthent':57B,88C 'unavail':123C 'under':65B,100C 'use':116C 'vendor':112C 'vigorconnect':9A,24A,26A,33B,35B,72C 'vulner':5A,77C,93C 'webservlet':52B,85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-10-13T16:15:07+00:00","kev":{"dateAdded":"2024-09-03","dueDate":"2024-09-24","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-20124","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20124","severity":null,"published_at":"2024-09-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T14:39:38+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-20124","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20124","severity":null,"published_at":"2021-10-13T16:15:07+00:00","modified_at":"2026-06-17T03:33:18+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}