CVE-2020-10547

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

37%p98

Published

Jun 4, 2020 (Jun 4, 2020)

Modified

Jun 17, 2026

Description

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Vendors: rconfig
Products: rconfig
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (36.6%)

In the news0 stories

No ingested article mentions this CVE yet.