CVE-2021-20123

A local file inclusion vulnerability has been identified in the Draytek VigorConnect 1.6.0-B3, specifically within the file download functionality of the DownloadFileServlet endpoint. This vulnerability allows an unauthenticated attacker to exploit the system by manipulating the input parameters to access and download arbitrary files from the underlying operating system. The root cause lies in improper validation of user input, which fails to restrict access to sensitive files. As a result, attackers can leverage this flaw to gain access to critical system files, configuration files, or even sensitive data, potentially leading to further exploitation of the system.

Exploitation of this vulnerability can occur through various attack vectors. An attacker could craft a malicious request to the DownloadFileServlet endpoint, specifying a file path that points to sensitive files on the server. For instance, by using directory traversal techniques, an attacker could navigate the file system and request files outside the intended directory. This could include system files such as password files, configuration files, or any other sensitive data stored on the server. The ability to download these files with root privileges significantly amplifies the threat, as it could lead to the extraction of credentials or sensitive information that could be used for further attacks, including privilege escalation or lateral movement within the network.

The real-world impact of this vulnerability is substantial, particularly for organizations that rely on the affected product for their operations. The ability to download arbitrary files can lead to severe data breaches, loss of confidentiality, and potential regulatory repercussions. For businesses, the risk extends beyond immediate financial loss; it can damage reputation, erode customer trust, and result in legal liabilities. Organizations may face significant remediation costs, including incident response, forensic analysis, and potential fines from regulatory bodies. Furthermore, if sensitive customer data is compromised, the long-term impact on customer relationships and brand integrity can be devastating.

To detect and mitigate this vulnerability, organizations should implement several strategies. First, it is essential to conduct a thorough security assessment of the affected systems to identify any instances of the vulnerability. Regular vulnerability scanning and penetration testing can help uncover weaknesses before they are exploited by malicious actors. Additionally, organizations should apply patches and updates provided by the vendor to remediate the vulnerability. Implementing strict input validation and sanitization measures can also help prevent unauthorized file access. Furthermore, employing web application firewalls (WAFs) can provide an additional layer of protection by filtering out malicious requests before they reach the application.

In conclusion, the local file inclusion vulnerability in Draytek VigorConnect 1.6.0-B3 poses a significant threat to organizations utilizing this product. The potential for unauthorized file access and data exfiltration underscores the importance of proactive security measures. By understanding the technical details of the vulnerability, recognizing the various attack vectors, and implementing effective detection and mitigation strategies, organizations can better protect themselves against the risks associated with this and similar vulnerabilities. Continuous monitoring and a robust security posture are essential to safeguard sensitive information and maintain operational integrity in an increasingly complex threat landscape.

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2021-20123, with new telemetry indicating the vulnerability is being actively targeted after a period of dormancy. Although the EPSS score has decreased slightly, reflecting a modest reduction in overall exploit likelihood, the recent uptick in detection signals increased adversary interest and potential exploitation attempts in the wild. This shift is significant because it suggests that threat actors may be refining their tactics or expanding targeting to leverage the local file inclusion flaw in DrayTek VigorConnect, which could lead to unauthorized access to sensitive system files with elevated privileges. Defenders should interpret this development as an indication that the vulnerability remains a viable attack vector, warranting continued vigilance despite the absence of new exploit details or confirmed ransomware usage. The evolving exploitation landscape underscores the necessity of maintaining robust monitoring and response capabilities to detect and mitigate attempts leveraging this high-severity vulnerability.

Update 2 — July 06, 2026

CSURFACE threat intelligence has identified a slight increase in activity related to CVE-2021-20123, reflected by a modest rise in detection events across our telemetry. While no new exploit techniques or ransomware affiliations have been observed, this uptick signals persistent interest from threat actors in leveraging the local file inclusion vulnerability within DrayTek VigorConnect. The stability of the EPSS score at a high percentile underscores the continued exploitability and relevance of this flaw in the current threat landscape. For defenders, this development highlights the necessity to maintain heightened monitoring and detection efforts, as the vulnerability remains an active vector for potential unauthorized access with elevated privileges. Although the overall risk profile remains consistent with previous assessments, the observed increase in exploitation attempts suggests that adversaries continue to probe and potentially prepare for more widespread exploitation.

Update 3 — July 16, 2026

CSURFACE threat intelligence has identified a slight increase in exploitation attempts targeting the local file inclusion vulnerability in DrayTek VigorConnect. While the overall frequency remains moderate, this uptick signals persistent adversary interest in leveraging the flaw to access sensitive system files with elevated privileges. The stability of the EPSS score at a high percentile continues to affirm the vulnerability’s exploitability, underscoring its relevance in current attack campaigns. Although no new exploit variants or ransomware affiliations have been detected, the incremental rise in detection activity suggests that threat actors are maintaining active reconnaissance and probing efforts. For defenders, this evolving pattern highlights the ongoing necessity to sustain vigilant monitoring and incident response capabilities, as the vulnerability remains a viable vector for unauthorized access despite the absence of significant changes in exploit sophistication or volume. Consequently, the threat level remains elevated but stable, reflecting continued exploitation potential without evidence of escalation into widespread or more aggressive attacks.