CVE-2021-20123

DrayTek VigorConnect 1.6.0-B3 contains a path traversal/local file inclusion flaw (CWE-22) in the file download functionality of its DownloadFileServlet endpoint. An unauthenticated attacker can send a crafted request with directory-traversal sequences to that endpoint, escaping the intended download path. Successful exploitation allows the attacker to read arbitrary files from the underlying operating system with root privileges, potentially exposing configuration, credentials, and key material. Any organization running the affected version of VigorConnect — DrayTek's on-premises network management suite — is exposed, especially where the web interface is reachable from untrusted networks. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-09-03, news reports describe active exploitation hitting DrayTek products, and EPSS assigns a 90.2% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade VigorConnect beyond 1.6.0-B3 to the latest vendor release per DrayTek's instructions, or discontinue use of the product if mitigations are unavailable, as required by the CISA KEV listing. Until patched, restrict access to the VigorConnect web interface, including the DownloadFileServlet endpoint, to trusted management networks via firewall rules or VPN. Also check exposed instances for signs that sensitive files (e.g., password files or private keys) were retrieved, and rotate any credentials accessible to the host.