ACTIVELY EXPLOITED
CVE-2021-20123: Draytek VigorConnect Path Traversal Vulnerability
| Vendor | DrayTek |
|---|---|
| Product | VigorConnect |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Sep 2024 |
| CISA federal deadline | 24 Sep 2024 |
| Weakness (CWE) | CWE-22 |
Required action (CISA's text)
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
SOURCES
Other DrayTek flaws
- CVE-2024-12987: DrayTek Vigor Routers OS Command Injection Vulnerability
- CVE-2020-15415: DrayTek Multiple Vigor Routers OS Command Injection Vulnerability
- CVE-2021-20124: Draytek VigorConnect Path Traversal Vulnerability
- CVE-2020-8515: Multiple DrayTek Vigor Routers Web Management Page Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.