CVE-2020-10546

EPSS 87.3%◆ VulnCheck KEV

Vexday Risk Score

62High priority

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 87.3%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

04 Jun 2020Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Affected products

n/a · n/a

References

https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/