Critical Path Traversal (CVE‑2021‑20123) in DrayTek VigorConnect Enables Unauthenticated Root‑Level File Access
What It Is – The DownloadFileServlet endpoint in DrayTek VigorConnect suffers a path‑traversal flaw that lets an unauthenticated attacker request arbitrary files from the underlying operating system. The file is returned with the privileges of the service process (root).
Exploitability – Publicly disclosed; proof‑of‑concept code is available. No authentication is required, making remote exploitation trivial. CVSS v3.1 base score: 9.8 (Critical).
Affected Products – DrayTek VigorConnect (all firmware versions prior to the vendor’s security advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring and rapid patch deployment to keep control evidence up‑to‑date.
- Highlights gaps in file‑integrity and access‑control logging that auditors will scrutinize during security assessments.
- Provides a concrete example of why defensible evidence of remediation (patch records, configuration baselines) is essential for maintaining a trusted posture.
Recommended Actions
- Apply the vendor‑released firmware patch immediately.
- Verify the running version on all VigorConnect appliances via an automated inventory scan.
- Update your vulnerability‑management program to include this CVE and map it to the “protect against unauthorized file access” control area.
- Capture remediation evidence (patch logs, configuration snapshots) for audit readiness.
- Review logging settings on the device to ensure successful download attempts are recorded and retained.
Source: CISA KEV – CVE‑2021‑20123