Lucene search

CISACISA-KEV-CVE-2021-20124

HistorySep 03, 2024 - 12:00 a.m.

Draytek VigorConnect Path Traversal Vulnerability

2024-09-0300:00:00

CISA

www.cisa.gov

draytek

vigorconnect

path traversal

vulnerability

file download

webservlet endpoint

unauthenticated attacker

arbitrary files

root privileges

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

Low

EPSS

0.492

Percentile

97.6%

JSON

Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.