CVE-2021-20125

PoC —

CVSS 3.1

9.8 critical

EPSS

4%p90

Published

Oct 13, 2021 (Oct 13, 2021)

Modified

Jun 17, 2026

Description

An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges.

Vendors: draytek
Products: vigorconnect
Weakness: CWE-22, CWE-434
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.9%)

In the news0 stories

No ingested article mentions this CVE yet.