DrayTek · VigorConnect
CVE-2021-20124
Draytek VigorConnect Path Traversal Vulnerability
무엇인가
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
CISA: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
할 일
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2024년 9월 24일
DrayTek의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2024. 9. 3. | Path Traversal Vulnerability | VigorConnect | 높음 7.5 | 90% |
| 2025. 5. 15. | OS Command Injection | Vigor Routers | 보통 6.9 | 98% |
| 2024. 9. 30. | OS Command Injection | Multiple Vigor Routers | 치명적 9.8 | 84% |
| 2021. 11. 3. | Multiple DrayTek Vigor Routers Web Management Page | Multiple Vigor Routers | 치명적 9.8 | >99.9% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.