CVE-2020-12258: 
rConfig vulnerability analysis and mitigation

rConfig 3.9.4 contains a session fixation vulnerability (CVE-2020-12258) due to improper handling of session expiry and randomization. The application can reuse a session, allowing an attacker to potentially exploit this vulnerability in conjunction with other vulnerabilities like CVE-2020-12256 (NVD).

The vulnerability exists because the application fails to properly randomize session IDs and allows session reuse between pre-login and post-login states. An attacker can verify this by checking that the same session ID is maintained before and after authentication. The vulnerability can be exploited by chaining it with XSS attacks to set arbitrary session IDs (GitHub).

When successfully exploited, this vulnerability allows an attacker to potentially hijack user sessions by setting predefined session IDs through XSS attacks. This could lead to unauthorized access to user accounts and compromise of user sessions (GitHub).

The vulnerability can be exploited by setting a custom session ID through XSS attacks. For example, an attacker can use the URL pattern 'https://ip-rconfig/configDevice.php?rid=">document.cookie="PHPSESSID=123456789"' to set an arbitrary session ID. This vulnerability becomes particularly dangerous when chained with other vulnerabilities like CVE-2020-12256 (GitHub).

The vulnerability exists in rConfig version 3.9.4. Organizations should ensure proper session management by implementing session regeneration upon login and maintaining proper session randomization (NVD).