CVE-2020-10221

rConfig versions through 3.94 contain an OS command injection flaw (CWE-78) in lib/ajaxHandlers/ajaxAddTemplate.php. An authenticated attacker with a valid low-privilege account sends shell metacharacters in the 'fileName' POST parameter, which the script passes to the operating system without sanitization. Successful exploitation yields arbitrary command execution on the underlying server with the privileges of the web service, enabling full host compromise and, by extension, access to the network devices rConfig manages. Any organization running an affected rConfig installation, particularly one exposed to the internet, is affected. The flaw has public proof-of-concept exploits, an EPSS exploitation probability of 80.2%, and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, indicating exploitation in the wild.

What to do: Upgrade rConfig to a release newer than 3.94 following the vendor's update instructions, per the CISA KEV required action. Until patched, restrict the rConfig web interface to trusted networks and enforce strong authentication, since exploitation requires valid credentials. Review logs for POST requests to lib/ajaxHandlers/ajaxAddTemplate.php containing shell metacharacters in the fileName parameter, and check the rConfig host for unexpected processes or outbound connections indicating compromise.