Description
Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Draytek VigorConnect | n/a / Draytek VigorConnect | 1.6.0-B3 | affected |
| vigorconnect | draytek / vigorconnect | 1.6.0 | affected |