CVE-2020-12256

medium · 5.4

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php.

5.4

CVSS

95.8%

EPSS (exploit prob.)

100th

EPSS percentile

2020-05-18

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
rconfig	rconfig	3.9.4

Check a specific version with /api/v1/cve/match.

References

https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8
https://gist.github.com/farid007/8855031bad0e497264e4879efb5bc9f8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2020-12256