CVE-2020-10549: SQL Injection
Published Jun 4, 2020
·Updated
rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.
Affected Software
1 affected component
rConfig rConfig<=3.9.4
Event History
Jun 4, 2020
CVE Published
via MITRE·03:24 AM
Data Sourced
via MITRE·03:24 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-10549?
The severity of CVE-2020-10549 is critical with a CVSS score of 9.8.
2
What is CVE-2020-10549?
CVE-2020-10549 is a vulnerability in rConfig 3.9.4 and previous versions that allows unauthenticated SQL injection.
3
How does CVE-2020-10549 impact rConfig?
CVE-2020-10549 allows an attacker to perform an unauthenticated SQL injection attack, potentially gaining access to monitored network devices.
4
How can I fix CVE-2020-10549?
To fix CVE-2020-10549, you should update to a patched version of rConfig.
5
Is there any additional information about CVE-2020-10549?
Yes, you can find more details about CVE-2020-10549 in the references provided.