CVE-2021-20124

What it actually does

CVE-2021-20124 is a path traversal/local file inclusion vulnerability in DrayTek VigorConnect 1.6.0-B3. The vulnerable file download functionality exposed through the WebServlet endpoint fails to properly constrain requested file paths, allowing an unauthenticated remote attacker to request arbitrary files from the underlying operating system. Because the affected service can read files with root privileges, successful exploitation can expose highly sensitive local files such as system account data, application configuration, credentials, keys, logs, and other files readable by the service account. The vulnerability primarily impacts confidentiality; it does not directly provide file write or command execution, but the disclosed data can enable follow-on compromise.

Why it matters to the business

An internet-exposed or otherwise reachable VigorConnect instance can be used as a source of credential, configuration, and operational data theft without authentication. Exposure of router-management credentials, stored secrets, configuration backups, or system files may allow attackers to pivot into managed network infrastructure, modify device configurations through other means, or prepare broader intrusion activity. This vulnerability is listed in CISA KEV with a remediation due date of 2024-09-24 and has active in-the-wild exploitation with a high EPSS score of 0.70659, making it a priority issue for organizations still running affected versions.

How an attack unfolds

An attacker first identifies a reachable DrayTek VigorConnect deployment and probes the WebServlet file download functionality. They then submit crafted file download requests containing path traversal sequences that escape the intended download directory and reference files elsewhere on the operating system. Because the request does not require authentication and the service can access files with elevated privileges, the server returns the requested file contents. The attacker may start with proof-of-access files such as /etc/passwd, then attempt to retrieve application configuration, credentials, private keys, session data, logs, or network-management information. If useful secrets are recovered, they may be reused to access VigorConnect, managed DrayTek devices, administrative portals, VPNs, or other internal services.

How to fix it

Upgrade DrayTek VigorConnect to a vendor-supported version that is not affected by this vulnerability. No fixed version was provided in the input data, so administrators should consult DrayTek advisories and release notes and avoid running VigorConnect 1.6.0-B3. If immediate upgrade is not possible, remove direct internet exposure, restrict access to trusted administrative networks or VPNs, enforce network-layer allowlisting, and monitor or block requests to WebServlet containing path traversal patterns. Rotate any credentials, API keys, device passwords, or secrets that may have been stored on or accessible from the affected server. Treat exposed management systems as potentially compromised until logs and filesystem artifacts are reviewed.

How to confirm the fix worked

Confirm the deployed VigorConnect version is not 1.6.0-B3 or another affected build according to DrayTek guidance. Verify that the WebServlet file download functionality no longer returns files outside the intended directory when tested with benign traversal payloads in an authorized assessment. Review web server, application, reverse proxy, and WAF logs for historical requests to WebServlet containing ../, encoded traversal variants, or sensitive file names such as /etc/passwd or /etc/shadow. Confirm internet-facing exposure has been removed or restricted to approved administrative sources. Validate that credentials stored on or used by VigorConnect have been rotated where exposure is plausible.

Typical attack path

1. Discover a reachable DrayTek VigorConnect web interface or management service.
2. Send unauthenticated requests to the WebServlet file download functionality.
3. Include path traversal payloads such as ../ or URL-encoded equivalents to escape the expected download directory.
4. Request sensitive local files from the underlying operating system.
5. Review downloaded files for credentials, configuration data, keys, tokens, topology information, or administrative details.
6. Use recovered information for lateral movement, device takeover, network reconnaissance, or follow-on intrusion activity.

How to detect it

To determine whether exploitation already occurred, review HTTP access logs from VigorConnect, embedded web server logs, reverse proxies, WAFs, load balancers, and network sensors for requests to WebServlet that include path traversal strings or references to sensitive operating system files. Focus on unauthenticated requests, unusual source IPs, repeated 200 responses with abnormal response sizes, and requests using URL-encoded traversal sequences. Look for access to /etc/passwd, /etc/shadow, configuration files, keys, logs, backup files, and application directories. Correlate suspicious requests with any subsequent administrative logins, configuration exports, device-management actions, password changes, VPN changes, or access from the same source IPs. If logs are limited, perform host forensics for shell history, downloaded artifacts, unexpected file reads where auditing is enabled, web access log rotation gaps, and unusual outbound connections following suspicious file-download activity.

• WebServlet
• ../
• ..%2f
• ..%2F
• %2e%2e%2f
• %2e%2e%2F
• %252e%252e%252f
• /etc/passwd
• /etc/shadow
• /etc/group
• /etc/hosts
• /etc/issue
• /proc/self/environ
• /root/.ssh/id_rsa
• /root/.ssh/authorized_keys
• /home/
• WEB-INF
• download
• file=

What your security team should do

• Immediately inventory DrayTek VigorConnect deployments and identify any instance running version 1.6.0-B3 or other unsupported/vulnerable builds.
• Prioritize remediation because the vulnerability is in CISA KEV, has active exploitation, and has a high EPSS probability of exploitation.
• Upgrade to a vendor-supported fixed release or decommission the affected VigorConnect instance if no safe upgrade path is available.
• Restrict VigorConnect access to trusted administrative networks or VPNs; do not expose the service directly to the internet.
• Search historical logs for unauthenticated WebServlet download requests containing traversal strings or sensitive file paths.
• Rotate credentials, device passwords, API keys, and administrative secrets that may have been stored in VigorConnect configuration files or on the host.
• Review managed DrayTek devices for unauthorized configuration changes, new administrative users, unexpected VPN settings, or altered remote-management exposure.
• Add WAF, reverse proxy, and SIEM detections for traversal attempts against WebServlet and repeated requests for Linux system files.