CVE-2020-10548

CRITICAL EXPLOITED NUCLEI

rconfig < 3.9.4 - Unauthenticated SQL Injection via devices.inc.php

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-10548 has been observed exploited in the wild (reported by VulnCheck KEV). A Nuclei detection template is also available.

Description

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Nuclei Templates (1)

rConfig 3.9.4 - SQL Injection
CRITICALby madrobot
Shodan: http.title:"rconfig"
FOFA: title="rconfig"

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/

Scores

CVSS v3 9.8
EPSS 0.3611
EPSS Percentile 98.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2023-11-17
CWE
CWE-89
Status published
Products (1)
rconfig/rconfig < 3.9.4
Published Jun 04, 2020
Tracked Since Feb 18, 2026