Is CVE-2021-20123 (Draytek VigorConnect Path Traversal Vulnerability) being exploited in the wild?

Yes. CISA added CVE-2021-20123 to its Known Exploited Vulnerabilities catalogue on 3 September 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Draytek VigorConnect contains a path traversal vulnerability in the DownloadFileServlet endpoint. Any organisation running the affected product should treat remediation as urgent.

What “being exploited in the wild” means for this CVE

For a CVE like CVE-2021-20123, the practical question is not whether the flaw exists, but whether attackers are already using it against real systems. CISA’s inclusion of the issue in the KEV catalogue is the clearest operational signal that the vulnerability has moved beyond theory and should be treated as an active exposure, not a low-priority hygiene item.

That distinction matters because path traversal issues often support direct file access, data disclosure, or follow-on compromise when the vulnerable endpoint is reachable. In this case, the issue sits in Draytek VigorConnect’s DownloadFileServlet endpoint, so exposure depends on whether that product is deployed and whether the affected interface is accessible from attacker-reachable networks.

How to confirm exposure without waiting for an incident

The first task is simple inventory work: confirm whether VigorConnect is present anywhere in your environment, whether the vulnerable endpoint is exposed, and whether any internet-facing or partner-facing system can reach it. A vulnerability can be “active” in the wild and still be harmless to you if you do not run the product, but if you do run it, you should assume exploitation attempts are already part of the threat picture.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to confirm remediation status and required action, and use authoritative product inventory rather than network scanning alone to avoid missing embedded or forgotten instances.

Because KEV listing reflects observed exploitation, organisations should prioritise this issue above the average internet bug, especially when the affected system is externally reachable, remotely administered, or integrated into broader administrative workflows.

What to do when patching is delayed

If remediation cannot happen immediately, focus on reducing reachability and blast radius. Restrict access to the management interface, segment the system away from general user traffic, and monitor for unusual requests to the affected servlet path or for unexpected file retrieval behaviour. Temporary compensating controls are not equivalent to a fix, but they can reduce the odds of successful abuse while change windows are arranged.

Review adjacent controls as well: log collection, alerting on suspicious HTTP patterns, and validation of any exposed administrative service paths can help distinguish benign traffic from attempted exploitation. For an active KEV item, delay should be an exception with a dated owner, not an open-ended plan.

Risk and Threat Considerations

An actively exploited path traversal flaw can be used for unauthorised file access, sensitive configuration disclosure, or as a foothold for deeper compromise if the application exposes useful local content. The main risk is not just initial access, but what that access reveals about the environment and whether it opens a route to credentials, configuration files, or administrative data.

Failure mechanism: Attackers send crafted requests to the vulnerable DownloadFileServlet endpoint to traverse outside the intended directory and retrieve files they should not be able to access.

Impact: Depending on what the application can read, the result can range from information disclosure to support for later compromise, persistence, or broader system abuse.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.SC-01 — Cybersecurity Supply Chain Risk Management Strategy	Active exploitation and vendor remediation depend on asset and third-party exposure management.
	ID.RA-01 — Asset Vulnerability Identification and Analysis	The question hinges on confirming whether the vulnerable product exists and is exposed.
Recommendation — Track exposure, vendor guidance, and remediation status for the affected product. Identify every VigorConnect instance and assess whether it is reachable.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exploitation requires continuous vulnerability identification and prioritisation.
Recommendation — Prioritise scanning and remediation for the affected system.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	The issue is an actively exploited vulnerability needing urgent remediation tracking.
Recommendation — Track, validate, and remediate the vulnerable software as a high-priority item.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	Actively exploited flaws require controlled vulnerability management and remediation handling.
Recommendation — Apply vulnerability management procedures and verify remediation for the affected host.

Practitioner Guidance

What to verify: Confirm whether any instance of Draytek VigorConnect is internet-facing, internally reachable from broad user networks, or exposed through reverse proxies, VPNs, or admin jump paths. If it is, treat the asset as priority remediation even before you finish a full impact assessment.

Decision rule: If you cannot patch immediately, remove public reachability first, then tighten monitoring around the affected endpoint and review logs for suspicious file-access patterns. If the system already shows unexplained requests, treat it as a possible compromise investigation rather than a pure patching exercise.

Practitioner takeaway: For a KEV-listed flaw, the key judgement is speed plus scope control, patch quickly, and if patching slips, make the service harder to reach while checking whether it has already been probed or abused.