CVE-2021-20127: High severity draytek vigorconnect vulnerability

Published Oct 13, 2021

Updated

An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3. This allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges.

Affected Software

1 affected component

DrayTek VigorConnect=1.6.0-beta3

Event History

Oct 13, 2021

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2021-20127?

CVE-2021-20127 is an arbitrary file deletion vulnerability in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3.

How does CVE-2021-20127 affect Draytek VigorConnect?

CVE-2021-20127 allows an authenticated user to arbitrarily delete files in any location on the target operating system with root privileges.

What is the severity of CVE-2021-20127?

The severity of CVE-2021-20127 is high with a CVSS score of 8.1.

How can I fix CVE-2021-20127?

There is no known fix for CVE-2021-20127 at the moment. It is recommended to contact the vendor for further guidance.

Where can I find more information about CVE-2021-20127?

You can find more information about CVE-2021-20127 on the Tenable website: https://www.tenable.com/security/research/tra-2021-42