Summary
Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
- Vendor
- DrayTek
- Product
- VigorConnect
- Added to KEV
- Sep 3, 2024
- Remediation due
- Sep 24, 2024 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-22
- EPSS
- 95.9% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References