Cross-Site Request Forgery Vulnerability in Draytek VigorConnect
CVE-2021-20126

8.8HIGH

Key Information:

Vendor

Draytek
Status
Draytek Vigorconnect
Vendor
CVE Published:
13 October 2021

What is CVE-2021-20126?

Draytek VigorConnect version 1.6.0-B3 is vulnerable to cross-site request forgery (CSRF) attacks due to a lack of appropriate verification mechanisms. This vulnerability allows an attacker to execute unauthorized actions on behalf of an unsuspecting user, as the application does not ensure that incoming requests are valid or intentionally generated by authenticated users. This weakness can lead to significant security risks, including unauthorized data access or modifications.

Affected Version(s)

Draytek VigorConnect 1.6.0-B3

References

https://www.tenable.com/security/research/tra-2021-42
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.