What is CVE-2021-20124?

CVE-2021-20124 is a local file inclusion vulnerability in DrayTek VigorConnect 1.6.0-B3 that allows unauthenticated attackers to download arbitrary files from the server with root privileges. The flaw exists in the WebServlet endpoint's file download functionality, which fails to sanitize path traversal sequences in user-supplied file paths.

How is CVE-2021-20124 related to CVE-2021-20123?

Both vulnerabilities affect DrayTek VigorConnect 1.6.0-B3 with identical path traversal issues, but in different servlet endpoints. CVE-2021-20124 affects the WebServlet endpoint while CVE-2021-20123 affects the DownloadFileServlet endpoint. Both were discovered and documented by Tenable in the same research advisory (TRA-2021-42).

What data can an attacker steal using this vulnerability?

Because the VigorConnect application runs with root privileges, an attacker can download any file on the server, including password hashes (/etc/shadow), SSH private keys, database files containing managed device credentials, application configuration files, and TLS certificates with private keys.

Does CVE-2021-20124 require authentication?

No, this vulnerability can be exploited by any unauthenticated attacker who can reach the VigorConnect web interface over the network. This makes it critically important to ensure that VigorConnect is never directly exposed to the internet and is only accessible from trusted management networks.

CVE-2021-20124

HIGH(7.5)KEVLikely Exploited

Draytek VigorConnect Path Traversal Vulnerability

Description

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

KEV Information

Vendor

DrayTek

Product

VigorConnect

Date Added

September 3, 2024

Due Date

September 24, 2024

Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CVSS Score

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in Calculator

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

3.9

Impact Score

3.6

CWEs

CWE-22Path Traversal

Improper Limitation of a Pathname to a Restricted Directory

Affected Products

Vendor	Product	Version
draytek	vigorconnect	1.6.0

Multiple CVSS Assessments

Source: [email protected](Primary)

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0(Secondary)

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.tenable.com/security/research/tra-2021-42(Exploit, Third Party Advisory)
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124(US Government Resource)

CVSS Score

7.5

HIGH(7.5)

EPSS Score

EPSS Score70.66%

EPSS Percentile99.3%

Dates

PublishedOctober 13, 2021

Last ModifiedJune 17, 2026

StatusAnalyzed

CVSS Versionv3.1

Quick Links

Back to CVE Database

Need Help With Vulnerability Management?

Our security experts can help you prioritize and remediate vulnerabilities effectively.

Get in Touch

CVE-2021-20124

Description

KEV Information

CVSS Score

CWEs

Affected Products

Multiple CVSS Assessments

References

CVSS Score

EPSS Score

Dates

Quick Links

Need Help With Vulnerability Management?

Platform

Resources

Company

Latest Articles