CVE-2021-20124
Draytek VigorConnect Path Traversal Vulnerability
Description
CVE-2021-20124 is a high-severity local file inclusion (LFI) vulnerability in DrayTek VigorConnect version 1.6.0-B3, specifically in the file download functionality of the WebServlet endpoint. The flaw allows an unauthenticated remote attacker to download arbitrary files from the underlying operating system with root privileges, potentially exposing sensitive configuration files, credentials, and system data. With an extraordinarily high EPSS score of 94.1% (99.9th percentile), this vulnerability is among the most actively exploited flaws currently tracked. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 24, 2024.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| draytek | vigorconnect | 1.6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.tenable.com/security/research/tra-2021-42(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20124(US Government Resource)
Weakness Type
Local File Inclusion / Path Traversal
Although no formal CWE has been assigned to CVE-2021-20124, the vulnerability is a local file inclusion (LFI) flaw that enables path traversal attacks against the DrayTek VigorConnect WebServlet endpoint. LFI vulnerabilities occur when an application accepts user-controlled input to construct file paths without properly sanitizing directory traversal sequences (such as ../). The attacker can escape the intended directory and access arbitrary files on the server's filesystem. In this case, the file download functionality runs with root privileges, meaning the attacker can read any file on the system regardless of file permissions — including /etc/shadow, SSH keys, database credentials, and application configuration files.
Learn more: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The CVSS v3.1 base score of 7.5 (High) reflects a vulnerability with significant confidentiality impact exploitable without any authentication. Confidentiality (C:H) is fully compromised, as the attacker can read any file on the system with root-level access. Integrity (I:N) and availability (A:N) are not directly affected since this is a read-only vulnerability — the attacker can download files but cannot directly modify or delete them. The network-based attack vector with no authentication requirement and no user interaction makes this trivially exploitable by any attacker who can reach the VigorConnect management interface.
From a business perspective, DrayTek VigorConnect is a centralized management platform for DrayTek networking devices. Compromising this system through arbitrary file download exposes the credentials and configurations of all managed network devices. An attacker can extract database files containing device credentials, VPN configurations, and administrative passwords that grant access to the entire managed network infrastructure. The EPSS score of 94.1% at the 99.9th percentile indicates that this is among the most targeted vulnerabilities in existence — exploitation is virtually guaranteed for any exposed instance. While the ransomware association is listed as unknown, the credential exposure from this vulnerability provides a clear path to broader network compromise suitable for ransomware deployment.
Exploit Maturity
CVE-2021-20124 has been confirmed as actively exploited in the wild, resulting in its addition to CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 24, 2024. The EPSS probability of 94.1% at the 99.9th percentile places this vulnerability in the top 0.1% of all tracked vulnerabilities for exploitation likelihood, indicating pervasive and ongoing exploitation activity.
Tenable published a detailed security research advisory (TRA-2021-42) documenting the vulnerability, including exploitation details for both this flaw and its companion vulnerability CVE-2021-20123 (which affects the DownloadFileServlet endpoint). The availability of detailed exploitation guidance from a reputable security research firm, combined with the trivial nature of exploitation (a simple HTTP request with path traversal sequences), means that both automated scanners and manual attackers can easily exploit this flaw. The ransomware association is classified as "Unknown," but the ability to extract credentials from a network management platform makes this a high-value target for any threat actor seeking to expand their access within an organization's network.
Remediation
- Update DrayTek VigorConnect — Upgrade to a version of VigorConnect newer than 1.6.0-B3 that addresses this vulnerability. Check DrayTek's support portal for the latest available version and apply the update immediately.
- Restrict network access to VigorConnect — Ensure the VigorConnect management interface is not exposed to the public internet. Place it behind a firewall and restrict access to only authorized administrator IP addresses or a dedicated management VLAN.
- Rotate all managed device credentials — Assume that credentials stored in VigorConnect have been compromised if the system was accessible to untrusted networks. Change all passwords for managed DrayTek devices, VPN configurations, and any administrative accounts stored in the VigorConnect database.
- Audit access logs for exploitation — Review VigorConnect web server logs for requests to the WebServlet endpoint containing path traversal sequences (such as
../patterns). Look for unusual file download requests, particularly for system files like/etc/passwd,/etc/shadow, or database files. - Implement a web application firewall (WAF) — Deploy a WAF in front of the VigorConnect interface configured to detect and block path traversal attacks. While not a substitute for patching, a WAF provides an additional detection and prevention layer against exploitation attempts.
Technical Details
The CVSS v3.1 vector for CVE-2021-20124 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, yielding a base score of 7.5 (High). Attack Vector (AV:N) confirms remote exploitation over the network. Attack Complexity (AC:L) indicates straightforward exploitation. Privileges Required (PR:N) means no authentication is needed. User Interaction (UI:N) confirms fully automated exploitation is possible. Scope (S:U) limits the affected component. Confidentiality (C:H) reflects complete exposure of all readable files, while Integrity (I:N) and Availability (A:N) remain unaffected since this is a read-only attack.
The vulnerability exists in the WebServlet endpoint's file download functionality within DrayTek VigorConnect 1.6.0-B3. The servlet accepts a file path parameter and serves the requested file to the client. Due to insufficient validation of the supplied path, an attacker can inject directory traversal sequences (e.g., ../../) to escape the intended download directory and access any file on the server's filesystem. Because the VigorConnect application runs with root privileges, the traversal attack can read files that are normally restricted to the root user, including /etc/shadow (password hashes), SSH private keys, application database files, and TLS private keys. The attack is a simple HTTP GET request with a crafted path parameter, making exploitation trivially automated. This vulnerability is closely related to CVE-2021-20123, which affects the same application's DownloadFileServlet endpoint with an identical path traversal issue — both were documented by Tenable's research team.
Frequently Asked Questions
What is CVE-2021-20124?
CVE-2021-20124 is a local file inclusion vulnerability in DrayTek VigorConnect 1.6.0-B3 that allows unauthenticated attackers to download arbitrary files from the server with root privileges. The flaw exists in the WebServlet endpoint's file download functionality, which fails to sanitize path traversal sequences in user-supplied file paths.
How is CVE-2021-20124 related to CVE-2021-20123?
Both vulnerabilities affect DrayTek VigorConnect 1.6.0-B3 with identical path traversal issues, but in different servlet endpoints. CVE-2021-20124 affects the WebServlet endpoint while CVE-2021-20123 affects the DownloadFileServlet endpoint. Both were discovered and documented by Tenable in the same research advisory (TRA-2021-42).
What data can an attacker steal using this vulnerability?
Because the VigorConnect application runs with root privileges, an attacker can download any file on the server, including password hashes (/etc/shadow), SSH private keys, database files containing managed device credentials, application configuration files, and TLS certificates with private keys.
Does CVE-2021-20124 require authentication?
No, this vulnerability can be exploited by any unauthenticated attacker who can reach the VigorConnect web interface over the network. This makes it critically important to ensure that VigorConnect is never directly exposed to the internet and is only accessible from trusted management networks.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.