rConfig Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for rConfig products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
5
In CISA KEV
1
Beyond CISA KEV
4
Sensor Observed
0
Virtual Patch Available
0
rConfig KEVs Added by Year
5 rConfig KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2020-10546
rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. Because, by default, nodes' passwords are stored... |
rConfig | High | Not in CISA | 17 Mar 2026 |
|
CVE-2020-13638
lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been... |
rConfig | High | Not in CISA | 01 Jun 2025 |
|
CVE-2020-10548
rConfig 3.9.4 and previous versions has unauthenticated devices.inc.php SQL injection. Because, by default, nodes' passwords are stored in... |
rConfig | High | Not in CISA | 06 Jun 2025 |
|
CVE-2019-16662
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php... |
rConfig | High | Not in CISA | 20 May 2025 |
|
CVE-2020-10221
lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in... |
rConfig | Confirmed | In CISA | 03 Nov 2021 |
Common Vulnerability Classes (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 2
- CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 2
- CWE-269 — Improper Privilege Management 1
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology