CVE-2020-10548

EPSS 37.3%◆ VulnCheck KEV

Vexday Risk Score

52Atenção

Decisão SSVC (CISA)

Act

Exploração + impacto → ação imediata

Maturidade do exploit

Exploit funcional

Exploit automatizável disponível (Nuclei/Metasploit).

CVSS —EPSS 37.3%KEV nãoPoC —Nuclei simMetasploit —Patch —

Ciclo de vida

04 jun 2020Publicada no NVD

Recomendação: Corrigir o quanto antes — há exploração ativa confirmada.

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Produtos afetados

n/a · n/a

Referências

https://github.com/theguly/exploits/blob/master/CVE-2020-10548.py https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/