CVE-2020-10548

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...

PT-2020-12197

Name of the Vulnerable Software and Affected Versions rConfig versions 3.9.4 and earlier Description The issue is related to an unauthenticated SQL injection in devices.inc.php, which can lead to lateral movement. Since nodes' passwords are stored in cleartext by default, an attacker can gain...

CVE-2020-10548: Improper Neutralization of Special Elements used in an SQL Command

rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices...