Veille CVE
CVE-2021-20123
7.5 Élevée Exploitée activementCatalogue CISA KEV — Draytek VigorConnect Path Traversal Vulnerability
Ajoutée le 03/09/2024 · Échéance de correction (agences US) : 24/09/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 7.5 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | 7.8 Élevée | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Faiblesses (CWE)
Références
- https://www.tenable.com/security/research/tra-2021-42 ExploitThird Party Advisory
- https://www.tenable.com/security/research/tra-2021-42 ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-20123 US Government Resource