CVE-2020-12256

MEDIUM NUCLEI

rConfig 3.9.4 - Reflected Cross-Site Scripting via deviceId Parameter

Title source: llm

Exploitation Summary

CVE-2020-12256 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.

Nuclei Templates (1)

rConfig 3.9.4 - Cross-Site Scripting

MEDIUMVERIFIEDby r3Y3r53

Shodan: http.title:"rConfig" || http.title:"rconfig"

FOFA: title="rconfig"

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8

Scores

CVSS v3 5.4

EPSS 0.9280

EPSS Percentile 99.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE

CWE-79

Status published

Products (1)

rconfig/rconfig 3.9.4

Published May 18, 2020

Tracked Since Feb 18, 2026