CVE-2021-20123

HIGH

7.5

CVSS Score

Published: October 13, 2021 at 03:47 PM UTC

Updated: June 17, 2026 at 03:33 AM UTC

1 product affected across 1 vendorVigorconnect

Using Draytek VigorConnect by N/A?

Get instant alerts when new vulnerabilities affect Draytek VigorConnect - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploitation

CISA KEV

Exploit prediction

EPSS 90%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score89.7%

EPSS (Exploit Prediction Scoring System) estimates a 89.7% chance this CVE is exploited in the wild within the next 30 days — higher than 100% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

Sep 3, 2024

Remediation Due

Sep 24, 2024

764 days overdue

Notes

https://www.draytek.com/about/security-advisory/vigorconnect-software-security-vulnerability-(cve-2021-20123-cve-2021-20129)

https://nvd.nist.gov/vuln/detail/CVE-2021-20123

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.