DrayTek VigorConnect - LFI (CVE-2021-20123)

CVE-2021-20123 is a vulnerability in DrayTek VigorConnect that allows unauthenticated attackers to exploit a local file inclusion flaw, enabling the download of arbitrary files from the underlying operating system with root-level access.

CrowdSec has been tracking this vulnerability and its exploits since 10th of March 2025.

CrowdSec network observations suggest that most exploitation of CVE-2021-20123 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. In addition, according to the CrowdSec network, attack volume against CVE-2021-20123 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attack attempts are typically directed at URLs containing acsserver/downloadfileservlet.