High · published October 13, 2021
CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 99.9th percentile for exploit probability.
🚨 An unauthenticated attacker could download any file on your system with root privileges — talk about a recipe for disaster! 🔥 Think of this like a restaurant's kitchen door left wide open, allowing anyone to waltz in and grab any recipe or ingredient they want. This vulnerability lets attackers stroll right into your system and pilfer sensitive files! An attacker could exploit this vulnerability to access files they shouldn't, potentially exposing sensitive information or critical configuration files. If you're running Draytek VigorConnect 1.6.0-B3, this could lead to catastrophic data breaches or the manipulation of key system settings. It's absolutely concerning!
Think of this like a restaurant's kitchen door left wide open, allowing anyone to waltz in and grab any recipe or ingredient they want. This vulnerability lets attackers stroll right into your system and pilfer sensitive files! This local file inclusion vulnerability in the WebServlet endpoint allows attackers to download arbitrary files from the server's filesystem without any authentication, effectively granting them root access to the system's files.
An attacker could exploit this vulnerability to access files they shouldn't, potentially exposing sensitive information or critical configuration files. If you're running Draytek VigorConnect 1.6.0-B3, this could lead to catastrophic data breaches or the manipulation of key system settings. It's absolutely concerning! Immediately update Draytek VigorConnect to the patched version that addresses this vulnerability. Check your configuration to ensure proper access controls are in place, and consider implementing additional security measures like firewalls. Don't forget to audit your system for any unauthorized access! You've got this! Take these steps and you'll be well on your way to locking down your systems. 🛡️