DrayTek VigorConnect Arbitrary File Download and Local File Inclusion (LFI) Vulnerability (CVE-2021-20123) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTDrayTek VigorConnect version 1.6.0-B3 and prior
Unauthenticated remote attackers can download arbitrary system files with root privileges, leading to full exposure of sensitive host operating system data
Immediately upgrade VigorConnect to the latest secure version and restrict access to the management interface from the public internet
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch by upgrading VigorConnect to the latest secure version. Use the following commands to update the service on a Linux host:
# Stop the VigorConnect service
sudo systemctl stop vigorconnect.service
# Download and install the latest secure package (example for Debian/Ubuntu)
wget https://www.draytek.com/ftp/VigorConnect/v1.6.1/vigorconnect_1.6.1_amd64.deb
sudo dpkg -i vigorconnect_1.6.1_amd64.deb
# Restart and verify the service status
sudo systemctl start vigorconnect.service
sudo systemctl status vigorconnect.service2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the VigorConnect management port (e.g., 8443) using firewall rules to allow only trusted IP addresses or VPN ranges.
# Block public access to VigorConnect port and allow only trusted admin subnet (e.g., 192.168.10.0/24)
sudo iptables -A INPUT -p tcp -s 192.168.10.0/24 --dport 8443 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8443 -j DROP
# Save the iptables configuration
sudo iptables-save | sudo tee /etc/iptables/rules.v43. Log Audit & IoC Verification Commands
Inspect the VigorConnect access logs for directory traversal patterns targeting the DownloadFileServlet endpoint.
# Search for LFI and directory traversal attempts in VigorConnect logs
grep -Ei 'DownloadFileServlet.*(\.\./|%2e%2e%2f|%2e%2e%252f)' /var/log/vigorconnect/*.log
# Check for unauthorized access attempts to sensitive system files
grep -i 'passwd' /var/log/vigorconnect/*.logStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A critical Local File Inclusion (LFI) and Directory Traversal vulnerability (CWE-22) exists in the DownloadFileServlet endpoint of DrayTek VigorConnect. The root cause lies in the insufficient validation and sanitization of user-supplied input parameters within the file download functionality. This allows an attacker to manipulate file paths using directory traversal sequences (e.g., ../), escaping the intended web root directory.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP GET request directly to the DownloadFileServlet endpoint. Because the VigorConnect application runs with elevated privileges (root), the servlet retrieves and returns any file specified by the attacker from the underlying operating system. This enables the retrieval of highly sensitive files, such as /etc/passwd, application configuration files, and database credentials.
3. Infrastructure & Business Impact
This vulnerability is highly critical and is actively exploited in the wild, as evidenced by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 0.8965, the likelihood of exploitation attempts is extremely high. Successful exploitation can lead to credential theft, enabling attackers to perform lateral movement and compromise the entire network infrastructure.
Official Vendor Advisories & References
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Frequently Asked SecOps Questions (CVE-2021-20123)
FAQQ1. How critical is CVE-2021-20123 and is it actively exploited in the wild?
CVE-2021-20123 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 89.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-20123?
Primary impacted vendors include draytek across vigorconnect. Scope summary: DrayTek VigorConnect version 1.6.0-B3 and earlier
Q3. What temporary mitigations or workarounds exist for CVE-2021-20123 before patching?
[Mitigation] Immediately upgrade VigorConnect to the latest secure version and restrict access to the management interface from the public internet Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-20123
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (draytek)
View Category →Ubiquiti UniFi OS Path Traversal and Remote Code Execution Vulnerability (CVE-2026-34909)
[Affected Scope] All Ubiquiti UniFi OS devices accessible via the network.
Fortinet FortiMail Path Traversal Vulnerability (CVE-2026-104286) - Unauthenticated Arbitrary File Write
[Affected Scope] FortiMail versions 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9, and all 7.0 versions.
Check Point Management Server Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-93616)
[Affected Scope] Check Point Management Server (R80.x, R81.x series)
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.