CVE-2020-10549

PoC ×2—

CVSS 3.1

9.8 critical

EPSS

32%p98

Published

Jun 4, 2020 (Jun 4, 2020)

Modified

Jun 17, 2026

Description

rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Vendors: rconfig
Products: rconfig
Weakness: CWE-89
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (32.1%)

In the news0 stories

No ingested article mentions this CVE yet.