# CVE-2021-20123: DrayTek VigorConnect - LFI

> Live exploitation tracking for CVE-2021-20123 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-20123

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** DrayTek VigorConnect
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

## Description

A local file inclusion vulnerability exists in DrayTek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.

## CrowdSec analysis

[CVE-2021-20123](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-20123) is a vulnerability in DrayTek VigorConnect that allows unauthenticated attackers to exploit a local file inclusion flaw, enabling the download of arbitrary files from the underlying operating system with root-level access.

CrowdSec has been tracking this vulnerability and its exploits since 24th of September 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-20123 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-20123 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-20123 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attack attempts are typically directed at URLs containing `acsserver/downloadfileservlet`.

## Timeline

- 2021-10-13: CVE Published. CVE-2021-20123 is published to NVD.
- 2024-09-03: CISA KEV. CVE-2021-20123 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-09-24: Rule Released. CrowdSec releases a rule to detect CVE-2021-20123 exploitation attempts against the CrowdSec Network.
- 2024-09-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-20123 for the first time.

## References

- https://www.tenable.com/security/research/tra-2021-42
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-20123.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-20123) follows observed exploitation activity for CVE-2021-20123. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.