Risk Letters

Exploited vulnerability

CVE-2021-20124

TLP:CLEAR

Draytek VigorConnect Path Traversal Vulnerability

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Facts

  • Vendor: DrayTek
  • Product: VigorConnect
  • CVSS: 7.5
  • EPSS (probability of exploitation within 30 days): 95.9 %
  • On CISA's Known Exploited Vulnerabilities list since: 3 September 2024
  • First known exploitation: 3 September 2024
  • CISA's deadline for US federal agencies: 24 September 2024
  • Weakness: CWE-22
  • First seen by Risk Letters: 3 September 2024

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD