CVE-2021-20123
Draytek VigorConnect Path Traversal Vulnerability
Description
CVE-2021-20123 is a high-severity local file inclusion (LFI) vulnerability in DrayTek VigorConnect version 1.6.0-B3, affecting the file download functionality of the DownloadFileServlet endpoint. The flaw permits an unauthenticated remote attacker to download arbitrary files from the underlying operating system with root privileges, exposing sensitive data including system credentials, configuration files, and cryptographic keys. With an EPSS score of 94.0% (99.9th percentile), this vulnerability is among the most actively exploited flaws currently tracked. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 24, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| draytek | vigorconnect | 1.6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.tenable.com/security/research/tra-2021-42(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123(US Government Resource)
Weakness Type
Local File Inclusion / Path Traversal
Although no formal CWE has been assigned to CVE-2021-20123, the vulnerability is a local file inclusion (LFI) flaw exploitable through path traversal in the DrayTek VigorConnect DownloadFileServlet endpoint. Path traversal vulnerabilities arise when an application constructs filesystem paths using user-supplied input without properly neutralizing directory traversal characters such as ../. This allows the attacker to break out of the intended directory scope and access files anywhere on the filesystem. The DownloadFileServlet runs with root privileges, amplifying the impact by granting read access to every file on the system regardless of file permission settings.
Learn more: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The CVSS v3.1 base score of 7.5 (High) reflects a serious confidentiality breach achievable without any authentication. Confidentiality (C:H) is fully compromised, enabling the attacker to read any file accessible to the root user on the VigorConnect server. Integrity (I:N) and availability (A:N) are not directly impacted, as the vulnerability only allows file reading, not modification or deletion. The network attack vector with no privileges, no user interaction, and low complexity makes this vulnerability trivially exploitable with a single crafted HTTP request.
From a business perspective, DrayTek VigorConnect is a centralized management platform used to administer fleets of DrayTek routers, switches, and access points. A successful exploit exposes the management database containing credentials for all managed devices, VPN configurations, network topology data, and administrative passwords. This information allows an attacker to compromise the entire managed network infrastructure in a cascading attack. The EPSS score of 94.0% at the 99.9th percentile — placing it in the top 0.1% of all vulnerabilities — indicates virtually certain exploitation for any exposed instance. While the ransomware association is listed as unknown, the extracted credentials and network access provide a direct path for ransomware operators to move laterally across the managed network.
Exploit Maturity
CVE-2021-20123 has been confirmed as actively exploited in the wild, earning its placement in CISA's Known Exploited Vulnerabilities (KEV) catalog with a mandatory remediation deadline of September 24, 2024. The EPSS probability of 94.0% at the 99.9th percentile confirms that this vulnerability is among the most frequently exploited flaws across the entire CVE database.
Tenable published comprehensive security research (TRA-2021-42) documenting both this vulnerability and its companion flaw CVE-2021-20124, which affects the WebServlet endpoint of the same application. The research includes detailed exploitation information demonstrating how a simple HTTP request with directory traversal sequences can extract any file from the server. The trivial exploitation requirements — a single unauthenticated HTTP request — combined with the high-value target (a network device management platform) make this an extremely attractive vulnerability for automated exploitation campaigns. The ransomware classification is "Unknown," but the credential exposure enabled by this vulnerability aligns with common initial access techniques used by ransomware affiliates.
Remediation
- Upgrade DrayTek VigorConnect — Install a version of VigorConnect newer than 1.6.0-B3 that addresses this path traversal vulnerability. Contact DrayTek support or check their download portal for the latest patched release.
- Isolate the VigorConnect management interface — Ensure VigorConnect is only accessible from a dedicated management network or VLAN. Never expose the management interface to the public internet. Implement firewall rules that restrict access to specific administrator IP addresses.
- Rotate all credentials stored in VigorConnect — If the VigorConnect instance was accessible to untrusted networks at any point, assume all stored credentials are compromised. Reset passwords for all managed DrayTek devices, administrative accounts, VPN configurations, and any service accounts referenced in VigorConnect's database.
- Review server and application logs — Search web server access logs for requests to the DownloadFileServlet endpoint containing directory traversal patterns (
../or URL-encoded equivalents like%2e%2e%2f). Pay particular attention to requests for sensitive system files such as/etc/shadow,/etc/passwd, database files, or private keys. - Deploy network-level protections — Implement an intrusion detection/prevention system (IDS/IPS) with rules to detect path traversal attacks in HTTP requests. Configure WAF rules to block requests containing directory traversal sequences targeting the VigorConnect application.
Technical Details
The CVSS v3.1 vector for CVE-2021-20123 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, yielding a base score of 7.5 (High). Attack Vector (AV:N) confirms exploitation over the network. Attack Complexity (AC:L) indicates trivial exploitation requirements. Privileges Required (PR:N) means the attack works without any authentication. User Interaction (UI:N) confirms no victim action is needed. Scope (S:U) limits the directly affected component. Confidentiality (C:H) reflects complete file system read access, while Integrity (I:N) and Availability (A:N) are not impacted since this is a read-only vulnerability.
The vulnerability resides in the DownloadFileServlet endpoint of DrayTek VigorConnect 1.6.0-B3. This servlet provides file download functionality but fails to properly validate the requested file path parameter. An attacker sends an HTTP request to the DownloadFileServlet with a crafted path containing directory traversal sequences (e.g., ../../../../etc/shadow) that escape the intended download directory. Because the VigorConnect application executes with root-level privileges, the traversal attack succeeds in reading any file on the filesystem, regardless of Unix file permissions. The attack is as simple as a single HTTP GET request with the traversal payload, requiring no session tokens, cookies, or authentication headers. This vulnerability is the companion to CVE-2021-20124, which exploits the identical path traversal pattern in the WebServlet endpoint of the same application — both were discovered and documented by Tenable (TRA-2021-42).
Frequently Asked Questions
What is CVE-2021-20123?
CVE-2021-20123 is a local file inclusion vulnerability in DrayTek VigorConnect 1.6.0-B3 that allows an unauthenticated attacker to read arbitrary files from the server with root privileges. The flaw affects the DownloadFileServlet endpoint, which fails to sanitize directory traversal characters in file path parameters.
How does CVE-2021-20123 differ from CVE-2021-20124?
Both vulnerabilities are path traversal flaws in DrayTek VigorConnect 1.6.0-B3 with identical impact. CVE-2021-20123 affects the DownloadFileServlet endpoint, while CVE-2021-20124 affects the WebServlet endpoint. Both allow unauthenticated file download with root privileges and were documented in the same Tenable research advisory.
Can this vulnerability be exploited remotely?
Yes, this is a remotely exploitable vulnerability that requires only network access to the VigorConnect web interface. No authentication, credentials, or user interaction is needed. A single crafted HTTP request is sufficient to download any file from the server.
What should I do if my VigorConnect instance was exposed to the internet?
Assume full compromise. Immediately take the instance offline, update to a patched version, and rotate all credentials stored within VigorConnect, including passwords for all managed network devices, VPN configurations, and administrative accounts. Conduct a thorough investigation of network devices for signs of unauthorized access or configuration changes.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.