CVE-2026-70555: rConfig Core 8.2.3 < 8.2.13 Cleartext Credential Exposure via API
rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on read and missing authorization checks. Attackers can request GET /api/device-credentials, GET /api/device-credentials/{id}, or the external GET /api/v1/device-credentials endpoint, which authenticates any valid token as the seeded administrator account, to statelessly exfiltrate all stored plaintext device credentials. rConfig Pro is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rConfig Coreto a version that resolves this vulnerability.Fixed in 8.2.13
Event History
Frequently Asked Questions
Which deployments are affected?
rConfig Core versions 8.2.3 through versions before 8.2.13 are affected. rConfig Pro is not affected.
What does an attacker need to retrieve stored device credentials?
The attacker needs a valid authentication token. The external /api/v1/device-credentials endpoint treats any valid token as the seeded administrator account, allowing access to stored credentials.
What information can be exposed?
An authenticated attacker can retrieve cleartext SSH, Telnet, and enable passwords for managed devices. The affected API endpoints automatically decrypt credentials when they are read.
Which API endpoints should be reviewed for exposure?
Review access to GET /api/device-credentials, GET /api/device-credentials/{id}, and GET /api/v1/device-credentials. Requests to these endpoints may indicate attempted or successful credential retrieval.
What should be done if exposure is suspected?
Upgrade to rConfig Core 8.2.13 or later, then rotate SSH, Telnet, and enable passwords stored for managed devices. Also invalidate and replace authentication tokens that may have been available to untrusted users.