Description
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Draytek VigorConnect | 1.6.0-B3 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Draytek VigorConnect 1.6.0-B - Local File Inclusion http/cves/2021/CVE-2021-20123.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.