CVE-2020-10546

EPSS 87.3%◆ VulnCheck KEV

Vexday Risk Score

62Prioridade alta

Decisão SSVC (CISA)

Act

Exploração + impacto → ação imediata

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 87.3%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

04 jun 2020Publicada no NVD

Recomendação: Corrigir o quanto antes — há exploração ativa confirmada.

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Produtos afetados

n/a · n/a

Referências

https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/