CVE-2021-20124
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
—
EPSS — probability of exploitation (30 days)
96.3%
99.9th percentile
CISA KEV
Listed
Added 2024-09-03 · patch by 2024-09-24
Weakness / dates
—
Published — · modified —
Description
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.