CVE-2020-12259

MEDIUM NUCLEI

rConfig 3.9.4 - Reflected Cross-Site Scripting via rid GET Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2020-12259 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php.

Nuclei Templates (1)

rConfig 3.9.4 - Cross-Site Scripting
MEDIUMVERIFIEDby r3Y3r53
Shodan: http.title:"rConfig" || http.title:"rconfig"
FOFA: title="rconfig"

References (1)

Core 1
Core References

Scores

CVSS v3 5.4
EPSS 0.9477
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (1)
rconfig/rconfig 3.9.4
Published May 18, 2020
Tracked Since Feb 18, 2026