CVE-2021-20124: DrayTek VigorConnect path traversal in WebServlet, unauthenticated root file read, in CISA KEV
The short version: DrayTek VigorConnect has a path-traversal flaw (CVE-2021-20124) in its WebServlet file-download endpoint that lets an unauthenticated attacker read arbitrary files from the underlying OS with root privileges. It's a sibling to CVE-2021-20123 in the same product, it scores 7.5, and it's in CISA's Known Exploited Vulnerabilities catalog. Patch closes both — then rotate what was reachable. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated, root-level read of any file on a management server |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 69.25% · 99.28th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-09-24 |
| Known exploited? | Yes — added to KEV on 2024-09-03 |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read (root) |
| Requires authenticated session? | No — pre-authentication |
| Affected | DrayTek VigorConnect 1.6.0-B3 (and earlier) |
| Fixed in | Per DrayTek's advisory (exact fixed build: Unknown at time of writing — apply the vendor's update) |
What you need to know
CVE-2021-20124 is a path-traversal flaw in VigorConnect's WebServlet endpoint (the map-image download function). As with its sibling CVE-2021-20123, a crafted ../../ path lets an unauthenticated attacker escape the intended directory and read arbitrary files off the host — and because the service runs as root, nothing on the filesystem is out of reach.
They're two distinct bugs in two different endpoints, which is why both carry their own CVE, but the practical picture is the same:
- It's pre-authentication and root-level. No credential required; any file is readable.
- It's a management server. Leaked configs and credentials can reach the network devices VigorConnect administers.
- It's KEV-listed and easy to automate.
If you're addressing one of these DrayTek flaws, address both — the same update resolves the family.
How serious we see it
High — the same reasoning as its sibling.
An unauthenticated, root-level arbitrary-file-read on a network-management server is a skeleton key: no code execution on its own, but it surrenders the credentials and configuration an attacker needs to escalate or pivot. The KEV listing confirms real-world use. The reassuring part: it affects a specific product and version, DrayTek has shipped a fix, and confirming exposure is quick.
Recommendations
Straight from DrayTek's advisory and CISA:
- Patch now. Apply DrayTek's fixed VigorConnect release — the update resolves both this and CVE-2021-20123.
- Rotate what may have leaked. Treat credentials, keys, and secrets readable by the server — and on the managed devices — as exposed.
- Hunt. Review access logs for traversal patterns against
WebServlet(andDownloadFileServlet) before your patch date. - Harden exposure. Keep VigorConnect off the public internet; restrict it to trusted management networks or a VPN.
- Confirm your exposure first. Verify whether any VigorConnect instance is reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing VigorConnect interfaces from little more than your domain, fingerprints the product, and flags exposure tied to this KEV-listed vulnerability so it rises to the top of your results. That outside-in view catches a management server that was quietly exposed — surfaced as a ranked finding before its files become an attacker's roadmap to your network gear.