CVE-2021-29005

HIGH

rConfig 3.9.6 - Incorrect Default Permissions via chmod Command

Title source: llm
STIX 2.1

Description

Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server.

References (2)

Core 2
Core References
Vendor Advisory x_refsource_misc
http://rconfig.com

Scores

CVSS v3 8.8
EPSS 0.0183
EPSS Percentile 76.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-276
Status published
Products (1)
rconfig/rconfig 3.9.6
Published Oct 11, 2021
Tracked Since Feb 18, 2026