CVE-2020-10546: SQL Injection
Published Jun 4, 2020
·Updated
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
Affected Software
1 affected component
rConfig rConfig<=3.9.4
Event History
Jun 4, 2020
CVE Published
via MITRE·03:25 AM
Data Sourced
via MITRE·03:25 AM
Description
Frequently Asked Questions
1
What is CVE-2020-10546?
CVE-2020-10546 is a vulnerability in rConfig 3.9.4 and previous versions that allows unauthenticated SQL injection.
2
What is the severity of CVE-2020-10546?
The severity of CVE-2020-10546 is critical with a CVSS score of 9.8.
3
How does CVE-2020-10546 impact the security of the system?
CVE-2020-10546 allows an attacker to perform SQL injection and gain unauthorized access to monitored network devices.
4
Is CVE-2020-10546 easy to exploit?
Yes, there are public exploits available for CVE-2020-10546.
5
How can I fix CVE-2020-10546?
To fix CVE-2020-10546, upgrade rConfig to a version higher than 3.9.4 and secure the stored passwords.