CVE-2021-20123

7.5 highKEVEPSS 90%

High (7.5) in DrayTek VigorConnect. In CISA KEV since 2024-09-03. EPSS 90% chance of exploitation in the next 30 days.

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 90% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2024-09-03, due 2024-09-24
CWE: CWE-22
Published: 2021-10-13
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

draytek:vigorconnect

References

https://www.tenable.com/security/research/tra-2021-42
https://www.tenable.com/security/research/tra-2021-42
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123

Check your stack JSON