H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Vulnerability

CVE-2021-20123

Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Vulnerability
TypeVulnerability
External ID—
First seen2024-09-03
Last seen2024-09-03

Confidence

—

Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Labels

exploitedkev

CISA KEV context

Vendor / productDrayTek VigorConnect
Added2024-09-03
Due date2024-09-24
6 recorded

Relationships

mitigates
from Remediate CVE-2021-20123
Mitigation
related-to
to Manipulating Web Input to File System Calls
Technique
related-to
to Path Traversal
Technique
related-to
to Using Escaped Slashes in Alternate Encoding
Technique
related-to
to Using Slashes and URL Encoding Combined to Bypass Validation Logic
Technique
related-to
to Using Slashes in Alternate Encoding
Technique
2 external

References

nvd
CVE-2021-20123
open
cwe
CWE-22
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance