Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-20124

93
FAUCET Score

CVE-2021-20124 is a critical local file inclusion vulnerability in Draytek VigorConnect 1.6.0-B3, allowing unauthenticated attackers to download arbitrary files with root privileges. With a CVSS score of 7.5 (HIGH) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk. It is actively exploited in the wild, as confirmed by its presence in the CISA KEV catalog and extensive media coverage, despite the absence of public Metasploit or ExploitDB modules. The high community discussion and FAUCET Risk Score of 100/100 further underscore its severity and active threat landscape.

Impacted Technologies

VendorProductVersion(s)CPE
1.6.0CPE matchmatch criteria
cpe:2.3:a:draytek:vigorconnect:1.6.0:beta3:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
69.25%
Probability of exploitation in next 30 days
EPSS Percentile
99.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
Added to KEV · Sep 3, 2024
Nuclei: CVE-2021-20124 · May 13, 2022
This CVE's current EPSS score of 0.6925 is in the 99th percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Vendor Patches (5)

asteriskvendor investigatingvia llm_extracted
ciscovendor investigatingvia llm_extracted
miniovendor investigatingvia llm_extracted
opensshvendor investigatingvia llm_extracted
railsvendor investigatingvia llm_extracted

Vendor Advisories (5)

opensshllm-openssh-d6a63d7518184d6cCRITICAL

Multiple Vulnerabilities in Draytek VigorConnect 1.60.0-B3

Oct 12, 2021
railsllm-rails-3ee2d605d8d3d4b4CRITICAL

Multiple Vulnerabilities in Draytek VigorConnect 1.60.0-B3

Oct 12, 2021
miniollm-minio-82f06249fd1b229cCRITICAL

Multiple Vulnerabilities in Draytek VigorConnect 1.60.0-B3

Oct 12, 2021
ciscollm-cisco-e2b320a468b9b6bcCRITICAL

Multiple Vulnerabilities in Draytek VigorConnect 1.60.0-B3

Oct 12, 2021
asteriskllm-asterisk-ebe75604b0499798CRITICAL

Multiple Vulnerabilities in Draytek VigorConnect 1.60.0-B3

Oct 12, 2021

References

cisa.gov / known-exploited-vulnerabilities-catalog
US Government Resource
tenable.com / security/research/tra-2021-42
ExploitThird Party Advisory