CVE-2021-20124

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

References

https://www.tenable.com/blog/cve-2021-20123-cve-2021-20124-draytek-vulnerabilities-discovered-by-tenable-research-added-to

https://www.securityweek.com/draytek-vulnerabilities-added-to-cisa-kev-catalog-exploited-in-global-campaign/

https://securityonline.info/cisa-issues-alert-three-actively-exploited-vulnerabilities-demand-immediate-attention/?&web_view=true

https://www.tenable.com/security/research/tra-2021-42

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3