CVE-2021-20127

Name of the Vulnerable Software and Affected Versions Draytek VigorConnect version 1.6.0-B3

Description The issue is related to a lack of access control in the software for monitoring, managing, and configuring VigorAP access points and VigorSwitches switches in the local network. An arbitrary file deletion vulnerability exists in the file delete functionality of the "Html5Servlet" endpoint. This allows an authenticated user to delete files in any location on the target operating system with root privileges.

Recommendations For Draytek VigorConnect version 1.6.0-B3, consider disabling the file delete functionality of the Html5Servlet endpoint until a patch is available to prevent arbitrary file deletion with root privileges. Restrict access to the Html5Servlet endpoint to minimize the risk of exploitation.