CVE-2021-20123
Assigner: tenable
Published: 2021-10-13T15:47:58
State: PUBLISHED
affected: product: Draytek VigorConnect
vendor: n/a
versions: status: affected
version: 1.6.0-B3
descriptions: value: A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
problemTypes: descriptions: description: Path Traversal
type: text