CVE-2020-10549: 
rConfig vulnerability analysis and mitigation

rConfig 3.9.4 and previous versions contain an unauthenticated SQL injection vulnerability in the snippets.inc.php file. The vulnerability was discovered in early 2020 and assigned CVE-2020-10549. This critical security flaw affects all rConfig installations up to version 3.9.4, with the vulnerability being particularly severe as it requires no authentication to exploit (NVD, AttackerKB).

The vulnerability exists due to improper validation of user input in the snippets.inc.php file. The searchColumn parameter is neither escaped nor used in a prepared statement, leading to SQL injection. The vulnerability has received a CVSS v3.1 Base Score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating its severe nature and ease of exploitation (NVD).

The impact of this vulnerability is particularly severe because node passwords are stored in cleartext by default. When exploited, this vulnerability can lead to lateral movement, granting attackers access to monitored network devices. An attacker can potentially extract sensitive information including IP addresses, usernames, and passwords of managed devices (Guly Blog).

The vulnerability is highly exploitable as it requires no authentication and can be triggered through a simple HTTP request. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation. The exploit allows attackers to extract sensitive information from the database, including device credentials (Github Exploit).

The vulnerability was addressed in rConfig version 3.9.7. Organizations running affected versions should upgrade to the latest version immediately. As a temporary workaround, organizations should consider implementing additional network security controls to restrict access to the affected endpoints (Guly Blog).