CVE-2020-10548

EPSS 37.3%◆ VulnCheck KEV

Vexday Risk Score

52Attention

SSVC decision (CISA)

Act

Exploitation + impact → act immediately

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 37.3%KEV nãoPoC —Nuclei simMetasploit —Patch —

Lifecycle

04 Jun 2020Published on NVD

Recommendation: Patch as soon as possible — active exploitation confirmed.

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Affected products

n/a · n/a

References

https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/