CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
Configurations

Configuration 1 (hide)

cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:55

Type Values Removed Values Added
References () https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py - Exploit, Third Party Advisory () https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py - Exploit, Third Party Advisory
References () https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - Exploit, Third Party Advisory () https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - Exploit, Third Party Advisory

Information

Published : 2020-06-04 04:15

Updated : 2024-11-21 04:55


NVD link : CVE-2020-10548

Mitre link : CVE-2020-10548

CVE.ORG link : CVE-2020-10548


JSON object : View

Products Affected

rconfig

  • rconfig
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')