Detections
Analytics

rConfig RCE (CVE-2020-10221)

high Nessus Plugin ID 277601

Synopsis

The version of rConfig installed on the remote host is affected by a remote code execution vulnerability.

Description

The version of rConfig installed on the remote host is affected by a remote code executionvulnerability, as follows:

 - The flaw exists due to insufficient input validation in the userAdmin.inc.php component, which allows an unauthenticated attacker to upload arbitrary files to the server. By exploiting this, a remote attacker can execute arbitrary PHP code in the context of the web server, effectively gaining full control of the affected system.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

See vendor advisory.

See Also

http://www.nessus.org/u?700e8ea3

Plugin Details

Severity: High

ID: 277601

File Name: rconfig_CVE-2020-10221.nasl

Version: 1.1

Type: remote

Family: CGI abuses

Published: 12/5/2025

Updated: 12/5/2025

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: High

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2020-10221

CVSS v3

Risk Factor: High

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:rconfig:rconfig

Required KB Items: installed_sw/rConfig

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/3/2020

Vulnerability Publication Date: 8/3/2020

CISA Known Exploited Vulnerability Due Dates: 11/3/2021

Reference Information

CVE: CVE-2020-10221