CyberSec.Space Logo
返回 CVE 浏览器

CVE-2021-20125

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2021-10-13
Last Modified2024-11-21
Data SourcesNVD

Vulnerability Description

An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3. An unauthenticated attacker could leverage this vulnerability to upload files to any location on the target operating system with root privileges.

Affected Platforms (CPE)

📦
Draytek

Vigorconnect

= 1.6.0

References & Advisories

🔗 https://www.tenable.com/security/research/tra-2021-42
🔗 https://www.tenable.com/security/research/tra-2021-42

相关漏洞威胁

CVE-2021-201297.5

An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export sy...

CVE-2021-201285.4

The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored...

CVE-2021-201278.1

An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConn...

CVE-2021-201268.8

Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed,...