HIGHCVSS 7.5Actively exploited · CISA KEV since 2024-09-03Vulnerability
CVE-2021-20124
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Properties
- Euvd product
- Draytek VigorConnect
- Vulnerability name
- Draytek VigorConnect Path Traversal Vulnerability
- First seen
- 2025-10-21T23:25:28+00:00
- Cvss score
- 7.5
- Epss score
- 0.96308
- Last seen
- 2026-10-19T12:00:27+00:00
- Due date
- 2024-09-24
- Euvd assigner
- tenable
- Retrieved at
- 2026-10-21T01:24:47+00:00
- Exploited euvd since
- 2024-09-03T00:00:00+00:00
- Src batch id
- epss_history-20261020T103617Z-728ddd
- Source url
- https://epss.empiricalsecurity.com/epss_scores-2026-10-19.csv.gz
- Date added
- 2024-09-03
- Score
- 7.5
- Euvd base score version
- 3.1
- Fetched at
- 2026-10-20T10:36:20+00:00
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- In Signal since
- initial import (Sep 2026)
- Euvd base score
- 7.5
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Related Entities (4)
AFFECTS_PRODUCT (1)
DESCRIBES (1)
HAS_WEAKNESS (1)
INVOLVES (1)
Explore deeper with Ninja Signal's threat intelligence graph