DrayTek VigorConnect - LFI (CVE-2021-20123)

CVE-2021-20123 is a vulnerability in DrayTek VigorConnect that allows unauthenticated attackers to exploit a local file inclusion flaw, enabling the download of arbitrary files from the underlying operating system with root-level access.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2021-20123 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-20123 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-20123 is currently experiencing high visibility and active exploitation across the internet.

Attack attempts are typically directed at URLs containing acsserver/downloadfileservlet.