CVE-2021-20123

DrayTek's VigorConnect router allows unauthenticated attackers to download arbitrary OS files with root privileges via a path traversal flaw in the DownloadFileServlet endpoint.

This unpatched vulnerability enables attackers to exfiltrate sensitive system files from the underlying OS, posing a severe supply-chain and data-breach risk for DIB organizations relying on DrayTek hardware. Because the flaw allows arbitrary file access with root privileges, it is an RCE equivalent that could facilitate ransomware entry or lateral movement. DIB orgs must immediately audit all DrayTek devices for this CVE and apply vendor patches or replace compromised hardware to avoid FCA settlement exposure.

Shame score — A high-severity, actively exploited path traversal flaw in a widely deployed router product that allows unauthenticated root-level file access represents a critical negligence in vendor security hygiene.