VI
Product
VigorConnect
On CISA KEVExploited in the wild
7
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 1Low 0
Watch
Add VigorConnect to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-20124 In wildKEV | 7.5 | Oct 13 | Draytek VigorConnect Path Traversal Vulnerability Affected: 1.6.0 |
| CVE-2021-20123 In wildKEV | 7.5 | Oct 13 | Draytek VigorConnect Path Traversal Vulnerability Affected: 1.6.0 |
| CVE-2021-20125 | 9.8 | Oct 13 | An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek VigorConnect 1.6.0-B3 Affected: 1.6.0 |
| CVE-2021-20126 | 8.8 | Oct 13 | Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, consistent request was intentionally… Affected: 1.6.0 |
| CVE-2021-20127 | 8.1 | Oct 13 | An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-B3 Affected: 1.6.0 |
| CVE-2021-20129 | 7.5 | Oct 13 | An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs Affected: 1.6.0 |
| CVE-2021-20128 | 5.4 | Oct 13 | The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as user input is not properly sanitized Affected: 1.6.0 |
Showing 7