{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "DrayTek VigorConnect: 2 actively exploited vulnerabilities · updates",
  "home_page_url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124",
  "feed_url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124/feed.json",
  "description": "CVE-2021-20123: Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. CVE-2021-20124: Draytek VigorConnect contains a path traversal vulnerability in the file download functionality of the WebServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges. Added to the CISA KEV catalog on 2024-09-03. CVE-2021-20123, CVE-2021-20124 were assigned before 2024; the KEV listing came in 2024.",
  "language": "en",
  "_pwn": {
    "slug": "draytek-vigorconnect-cve-2021-20123-20124",
    "severity": "high",
    "status": "closed",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124/feed.xml",
    "llms": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124/llms.txt",
    "json": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124#2024-09-03-e04e6540",
      "url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124#2024-09-03-e04e6540",
      "title": "DrayTek VigorConnect: 2 actively exploited vulnerabilities: CISA added CVE-2021-20123 to the KEV catalog (federal deadline 2024-09-24)",
      "content_text": "DrayTek VigorConnect: 2 actively exploited vulnerabilities: CISA added CVE-2021-20123 to the KEV catalog (federal deadline 2024-09-24)\n\nSource: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "date_published": "2024-09-03T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124#2024-09-03-fa322ff7",
      "url": "https://pwn.watch/i/draytek-vigorconnect-cve-2021-20123-20124#2024-09-03-fa322ff7",
      "title": "DrayTek VigorConnect: 2 actively exploited vulnerabilities: CISA added CVE-2021-20124 to the KEV catalog (federal deadline 2024-09-24)",
      "content_text": "DrayTek VigorConnect: 2 actively exploited vulnerabilities: CISA added CVE-2021-20124 to the KEV catalog (federal deadline 2024-09-24)\n\nSource: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "date_published": "2024-09-03T00:00:00.000Z",
      "external_url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "tags": [
        "high"
      ]
    }
  ]
}