---
id: "CVE-2021-20124"
kind: "vulnerability"
aliases: ["CVE-2021-20124"]
title: "A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of\u2026"
severity: "high"
cvss: 7.8
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "DrayTek VigorConnect", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "draytek vigorconnect", "fixed": [], "affected": "= 1.6.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["draytek", "exploited", "infrastructure", "self-hosted", "vigorconnect"]
not_affected_if: ["no-vigorconnect-deployed"]
published_at: "2021-10-13T16:15:07+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20124", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20124", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of…

DrayTek VigorConnect, a management server for DrayTek routers and network gear, has a path traversal flaw in its WebServlet file download endpoint. An unauthenticated attacker can download arbitrary files from the underlying operating system with root privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DrayTek VigorConnect affected ? fixed ?
- vendor:draytek vigorconnect affected = 1.6.0 fixed ?

## Fix

Apply the mitigations from the vendor per CISA's required action, or stop using VigorConnect if no mitigation is available. The sources do not name a fixed version.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-20124
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-20124

## From the sources

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_