CVE-2020-10546

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

9.8

CVSS

87.3%

EPSS (exploit prob.)

100th

EPSS percentile

2020-06-04

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
rconfig	rconfig	<= 3.9.4

Check a specific version with /api/v1/cve/match.

References

https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/
https://github.com/theguly/exploits/blob/master/CVE-2020-10546.py
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-10546