Lucene search

K

Vigorconnect Security Vulnerabilities

cve
cve

CVE-2021-20126

Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the...

8.8CVSS

8.7AI Score

0.001EPSS

2021-10-13 04:15 PM
21
cve
cve

CVE-2021-20124

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root...

7.5CVSS

7.4AI Score

0.01EPSS

2021-10-13 04:15 PM
31
cve
cve

CVE-2021-20127

An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root...

8.1CVSS

7.9AI Score

0.001EPSS

2021-10-13 04:15 PM
20
cve
cve

CVE-2021-20129

An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system...

7.5CVSS

7.2AI Score

0.003EPSS

2021-10-13 04:15 PM
20
cve
cve

CVE-2021-20123

A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root...

7.5CVSS

7.4AI Score

0.015EPSS

2021-10-13 04:15 PM
48
cve
cve

CVE-2021-20125

An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root...

9.8CVSS

9.5AI Score

0.005EPSS

2021-10-13 04:15 PM
28
cve
cve

CVE-2021-20128

The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly...

5.4CVSS

5.3AI Score

0.001EPSS

2021-10-13 04:15 PM
23