CVE-2021-20126: CSRF
First published: Wed Oct 13 2021(Updated: )
Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Credit: vulnreport@tenable.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Draytek VigorConnect | =1.6.0-beta3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Draytek VigorConnect vulnerability?
The vulnerability ID for this Draytek VigorConnect vulnerability is CVE-2021-20126.
What is the severity of CVE-2021-20126?
The severity of CVE-2021-20126 is high, with a severity value of 8.8.
What is the affected software for CVE-2021-20126?
The affected software for CVE-2021-20126 is Draytek VigorConnect 1.6.0-B3.
What is the description of CVE-2021-20126?
CVE-2021-20126 refers to Draytek VigorConnect 1.6.0-B3 lacking cross-site request forgery protections and insufficiently verifying user-submitted requests.
Is there a fix available for CVE-2021-20126?
To fix CVE-2021-20126, it is recommended to update to a version of Draytek VigorConnect that includes cross-site request forgery protections and proper request verification.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/draytek
- canonical/draytek vigorconnect
- version/draytek vigorconnect/1.6.0-beta3