rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
References
Link | Resource |
---|---|
https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py | Exploit Third Party Advisory |
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ | Exploit Third Party Advisory |
https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py | Exploit Third Party Advisory |
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 04:55
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py - Exploit, Third Party Advisory | |
References | () https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/ - Exploit, Third Party Advisory |
Information
Published : 2020-06-04 04:15
Updated : 2024-11-21 04:55
NVD link : CVE-2020-10548
Mitre link : CVE-2020-10548
CVE.ORG link : CVE-2020-10548
JSON object : View
Products Affected
rconfig
- rconfig
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')