Arbitrary File Deletion in Draytek VigorConnect by Draytek
CVE-2021-20127

8.1HIGH

Key Information:

Vendor
Draytek
Status
Draytek Vigorconnect
Vendor
CVE Published:
13 October 2021

Summary

An arbitrary file deletion vulnerability is present in the file deletion functionality of the Html5Servlet endpoint within Draytek VigorConnect 1.6.0-B3. This security flaw allows an authenticated user to delete files arbitrarily from any location on the host operating system with root privileges, potentially leading to severe data loss and system compromise.

Affected Version(s)

Draytek VigorConnect 1.6.0-B3

References

https://www.tenable.com/security/research/tra-2021-42
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.