PT-2020-6842 · Rconfig · Rconfig

Engin Demirbilek · Published 2020-03-08 · Updated 2025-02-04 · CVE-2020-10221

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions rConfig versions 3.94 and earlier

Description The issue exists in the lib/ajaxHandlers/ajaxAddTemplate.php component of the rConfig utility for managing network device configurations, due to the lack of measures to neutralize special elements used in operating system commands. This allows a remote attacker to execute arbitrary operating system commands through the fileName parameter in a POST request.

Recommendations For versions 3.94 and earlier, consider disabling the ajaxAddTemplate.php component until a patch is available to prevent exploitation. Restrict access to the fileName parameter in the POST request to minimize the risk of arbitrary OS command execution.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00727

CVE-2020-10221

Affected Products

Rconfig

References · 14

• 🔥 https://github.com/EnginDemirbilek/EnginDemirbilek.github.io/blob/master/rconfig-3.93-rce.html · Exploit
• 🔥 http://packetstormsecurity.com/files/156687/rConfig-3.93-Authenticated-Remote-Code-Execution.html · Exploit
• 🔥 https://engindemirbilek.github.io/rconfig-3.93-rce · Exploit
• 🔥 https://exploit-db.com/exploits/48207 · Exploit
• https://bdu.fstec.ru/vul/2023-00727 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10221 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10221 · Note
• https://exploit.kitploit.com/2020/03/rconfig-393-authenticated-remote-code.html · Note
• https://cwe.mitre.org/data/definitions/78.html · Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://vulmon.com/exploitdetails?qidtp=packetstorm_exploits&qid=85d122ff0df2067290a863cffe078fa7 · Note
• https://t.me/cvenotify/109987 · Telegram Post
• https://vulmon.com/exploitdetails?qidtp=packetstorm_exploits&qid=85d122ff0df2067290a863cffe078fa7 · Note