DrayTek VigorConnect - LFI (CVE-2021-20123)

CVE-2021-20123 is a vulnerability in DrayTek VigorConnect that allows unauthenticated attackers to exploit a local file inclusion flaw, enabling the download of arbitrary files from the underlying operating system with root-level access.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-20123 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2021-20123 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2021-20123 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Attack attempts are typically directed at URLs containing acsserver/downloadfileservlet.