CVE-2021-20124

2021-10-1315:48:03

tenable

www.cve.org

cve-2021-20124

draytek vigorconnect

file download

webservlet endpoint

unauthenticated attacker

root privileges

EPSS

0.492

Percentile

97.6%

JSON

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

CNA Affected

[
  {
    "product": "Draytek VigorConnect",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "1.6.0-B3"
      }
    ]
  }
]