CVE-2020-10546

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

87%p100

Published

Jun 4, 2020 (Jun 4, 2020)

Modified

Jun 17, 2026

Description

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Vendors: rconfig
Products: rconfig
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (87.3%)

In the news0 stories

No ingested article mentions this CVE yet.