CVE-2020-10547

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because, by default, nodes' passwords are stored in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/theguly/exploits/blob/master/CVE-2020-10547.pyExploit, Third Party Advisory
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/Exploit, Third Party Advisory
https://github.com/theguly/exploits/blob/master/CVE-2020-10547.pyExploit, Third Party Advisory
https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/Exploit, Third Party Advisory

Timeline

Published: Jun 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-105489.8rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in c CVE-2020-105499.8rConfig 3.9.4 and previous versions has unauthenticated snippets.inc.php SQL injection. Because, by default, nodes' passwords are stored in CVE-2020-10555.5A cross-site-scripting (XSS) vulnerability exists when Active Directory Federation Services (ADFS) does not properly sanitize user inputs. A CVE-2020-105517.8QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authe CVE-2020-105528.1An issue was discovered in Psyprax before 3.2.2. The Firebird database is accessible with the default user sysdba and password masterke afte CVE-2020-105535.5An issue was discovered in Psyprax before 3.2.2. The file %PROGRAMDATA%\Psyprax32\PPScreen.ini contains a hash for the lockscreen (aka scree CVE-2020-105547.5An issue was discovered in Psyprax beforee 3.2.2. Passwords used to encrypt the data are stored in the database in an obfuscated format, whi CVE-2020-105578.8An issue was discovered in AContent through 1.4. It allows the user to run commands on the server with a low-privileged account. The upload CVE-2020-105586.5The driving interface of Tesla Model 3 vehicles in any release before 2020.4.10 allows Denial of Service to occur due to improper process se CVE-2020-10565.4An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an att CVE-2020-105605.9An issue was discovered in Open Source Social Network (OSSN) through 5.3. A user-controlled file path with a weak cryptographic rand() can b CVE-2020-105619.8An issue was discovered on Xiaomi Mi Jia ink-jet printer < 3.4.6_0138. Injecting parameters to ippserver through the web management backgrou