CVE-2021-20123, CVE-2021-20124: DrayTek Flaws Added to CISA KEV

On September 3, CISA added three new vulnerabilities to the KEV, two of which were discovered and responsibly disclosed to DrayTek by security researchers from Tenable Research. Despite patches being readily available for the past three years, CISA has noted evidence of active exploitation of the vulnerabilities.

CVE-2021-20123 and CVE-2021-20124 are both local file inclusion (LFI) vulnerabilities affecting the DownloadFileServlet and WebServlet endpoints on Draytek VigorConnect, a network management software that enables centralized configuration, monitoring, and management of multiple DrayTek wireless access points from a single interface.

For more information about the vulnerability, including the availability of patches and Tenable product coverage, please visit our blog..