CVE-2021-20123

What it actually does

CVE-2021-20123 is an unauthenticated local file inclusion/path traversal vulnerability in the DrayTek VigorConnect 1.6.0-B3 DownloadFileServlet file download endpoint. Because the endpoint does not properly constrain or canonicalize requested file paths, a remote attacker can request files outside the intended download directory. The service reads files with root-level privileges, so successful exploitation can expose highly sensitive operating system and application files such as password hashes, configuration files, private keys, logs, database connection strings, and VigorConnect application secrets. The flaw is primarily a confidentiality issue; it does not directly provide code execution, but stolen credentials or secrets can enable follow-on compromise.

Why it matters to the business

An exposed vulnerable VigorConnect server can leak sensitive system and network-management data to an unauthenticated internet attacker. Because VigorConnect is used to manage DrayTek devices, disclosure of configuration files, credentials, or keys can help attackers pivot into network infrastructure, take over managed devices, or prepare broader intrusion activity. This vulnerability is listed in CISA KEV with a remediation due date of 2024-09-24, has known in-the-wild exploitation, and has a high EPSS score of 0.75433, making it a priority exposure even though it is an older issue.

How an attack unfolds

An attacker first identifies a reachable DrayTek VigorConnect instance and probes the DownloadFileServlet endpoint. They then submit crafted file download requests containing path traversal sequences that escape the intended download directory and point to sensitive local files on the underlying operating system. If the instance is vulnerable, the servlet returns the requested file contents without authentication. The attacker can iterate through common Linux and application file paths to collect credentials, configuration values, SSH keys, password hashes, logs, or other secrets. Those materials may then be used for password cracking, credential reuse, device-management access, lateral movement, or follow-on exploitation of managed network equipment.

How to fix it

Upgrade DrayTek VigorConnect to a vendor-supported release that fixes the DownloadFileServlet path traversal issue. No exact fixed version was provided in the input, so administrators should consult DrayTek advisories and deploy the latest available VigorConnect version rather than remaining on 1.6.0-B3. If immediate upgrade is not possible, remove internet exposure, restrict access to trusted administrative networks or VPNs, enforce network-layer allowlisting, and block unauthenticated access to the DownloadFileServlet endpoint at a reverse proxy or web application firewall. Rotate credentials and secrets stored on or accessible from the VigorConnect host if exploitation is suspected, including device-management credentials, database passwords, API keys, SSH keys, and local account passwords.

How to confirm the fix worked

Confirm that no DrayTek VigorConnect 1.6.0-B3 instances remain deployed, especially on internet-facing interfaces. Verify the installed VigorConnect version from the product UI, package metadata, installation directory, or vendor-supported inventory tools. From a controlled test source, confirm that unauthenticated requests to DownloadFileServlet cannot retrieve files outside the intended download directory and that traversal payloads are rejected, normalized safely, or return an error. Review reverse proxy, web server, and application logs to confirm the endpoint is no longer externally reachable except from approved administrative networks. After remediation, repeat vulnerability scanning and external attack-surface discovery to ensure the service is not exposed.

Typical attack path

1. Scan for exposed DrayTek VigorConnect web interfaces.
2. Confirm the DownloadFileServlet endpoint is reachable without authentication.
3. Send crafted file download requests containing directory traversal sequences.
4. Retrieve sensitive local files such as operating system account files, application configuration, keys, or logs.
5. Extract credentials, tokens, hashes, network details, or device-management secrets from downloaded files.
6. Use recovered secrets for follow-on access, lateral movement, or compromise of managed infrastructure.

How to detect it

Review HTTP access logs from VigorConnect, embedded web server logs, reverse proxies, WAFs, load balancers, and network telemetry for requests to DownloadFileServlet containing directory traversal sequences or requests for sensitive local file paths. Focus on unauthenticated requests, HTTP 200 responses, unusually large response sizes, repeated probing from the same source, and requests using URL-encoded traversal patterns. Look for access to Linux system files, application configuration files, SSH keys, password databases, environment files, and log files. Correlate suspicious file-read events with subsequent authentication attempts to VigorConnect, DrayTek devices, SSH, VPN, or other management services. If endpoint telemetry is available, investigate web-service processes reading unusual files outside the VigorConnect application directory, especially /etc, /root, /home, /proc, and application configuration paths. Because this flaw is known to be exploited in the wild, absence of malware does not rule out compromise; the primary evidence may be web access logs and evidence of credential misuse after file disclosure.

• DownloadFileServlet
• GET /DownloadFileServlet
• POST /DownloadFileServlet
• DownloadFileServlet?
• ../
• ..%2f
• %2e%2e%2f
• ..%252f
• %252e%252e%252f
• ..%5c
• %2e%2e%5c
• /etc/passwd
• /etc/shadow
• /etc/group
• /etc/hosts
• /etc/hostname
• /etc/issue
• /etc/ssh/ssh_host_rsa_key
• /etc/ssh/ssh_host_dsa_key
• /etc/ssh/ssh_host_ecdsa_key
• /etc/ssh/ssh_host_ed25519_key
• /root/.ssh/id_rsa
• /root/.ssh/authorized_keys
• /proc/self/environ
• /proc/version
• /var/log/messages
• /var/log/syslog
• /var/log/auth.log
• /var/log/secure
• WEB-INF/web.xml

What your security team should do

• Treat this as urgent for any exposed VigorConnect deployment because it is in CISA KEV, has known active exploitation, and has a high EPSS score.
• Immediately inventory DrayTek VigorConnect instances and identify any running version 1.6.0-B3 or other unverified vulnerable builds.
• Upgrade to the latest vendor-supported VigorConnect release; if a fixed-version mapping is unavailable, do not rely on 1.6.0-B3 remaining in production.
• Remove direct internet exposure and restrict administrative access to trusted networks or VPN-only paths.
• Search historical logs for unauthenticated DownloadFileServlet requests containing traversal patterns or sensitive file paths.
• If suspicious access is found, perform incident response: preserve logs, identify files accessed, rotate exposed credentials, and review managed DrayTek devices for unauthorized changes.
• Add SIEM detections and WAF rules for traversal attempts against DownloadFileServlet and other file download endpoints.
• Monitor for follow-on authentication attempts using credentials or keys that may have been stored on the VigorConnect host.