CVE-2021-20123: DrayTek VigorConnect path traversal, unauthenticated root file read, in CISA KEV
The short version: DrayTek VigorConnect — the management software for DrayTek networking gear — has a path-traversal flaw (CVE-2021-20123) in its DownloadFileServlet endpoint that lets an unauthenticated attacker download arbitrary files from the underlying OS with root privileges. It scores 7.5 and it's in CISA's Known Exploited Vulnerabilities catalog. What leaks — system files, configs, credentials — is what makes it matter. Patch it, and rotate what was reachable. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated, root-level read of any file on a management server |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 74.28% · 99.43th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-09-24 |
| Known exploited? | Yes — added to KEV on 2024-09-03 |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read (root) |
| Requires authenticated session? | No — pre-authentication |
| Affected | DrayTek VigorConnect 1.6.0-B3 (and earlier) |
| Fixed in | Per DrayTek's advisory (exact fixed build: Unknown at time of writing — apply the vendor's update) |
What you need to know
CVE-2021-20123 is a path-traversal flaw in VigorConnect's DownloadFileServlet. By supplying a crafted ../../ path to the file-download parameter, an unauthenticated attacker escapes the intended directory and reads arbitrary files off the host — and because the service runs with root privileges, that means any file, including /etc/passwd, service configs, and stored secrets.
It's a read primitive, not code execution, but the details raise the stakes:
- It's pre-authentication and root-level. No login, and nothing on the filesystem is off-limits to the read.
- It's a management server. VigorConnect administers network devices, so leaked configs and credentials can open the door to the gear it manages.
- It's KEV-listed and readily automated — reflected in the high EPSS.
How serious we see it
High — above what a bare "information disclosure" label suggests.
An unauthenticated, root-level arbitrary-file-read on a network-management server is a skeleton key. It doesn't run code by itself, but it hands over the exact material — credentials, keys, configuration — an attacker needs to escalate or pivot to the managed devices. The KEV listing confirms this isn't hypothetical. The reassuring part: it affects a specific product and version, DrayTek has published a fix, and exposure is quick to confirm.
Recommendations
Straight from DrayTek's advisory and CISA:
- Patch now. Apply DrayTek's fixed VigorConnect release per their advisory.
- Rotate what may have leaked. Treat any credentials, keys, or secrets readable by the server — and on the devices it manages — as exposed, and rotate them.
- Hunt. Review access logs for traversal patterns (
../, encoded variants) againstDownloadFileServletbefore your patch date. - Harden exposure. Keep VigorConnect off the public internet; restrict it to trusted management networks or a VPN.
- Confirm your exposure first. Verify whether any VigorConnect instance is reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing VigorConnect interfaces from little more than your domain, fingerprints the product, and flags exposure tied to this KEV-listed vulnerability so it rises to the top of your results. Looking from the outside in is how you catch a management server that was quietly exposed — surfaced as a ranked finding before its files become an attacker's roadmap to your network gear.