Two unpatched RCE flaws in rConfig software expose servers to hack

guest · Nov 4, 2019

Two unpatched RCE flaws in rConfig software expose servers to hack
November 4, 2019
https://securityaffairs.co/wordpress/93391/hacking/rconfig-rce-flaws.html

rConfig is a completely open-source, network configuration management utility used to validate and manage network devices, including switches, routers, firewalls, and load-balancer.
The cyber security expert Mohammad Askar has discovered two critical remote code execution vulnerabilities in the rConfig utility, it also published proof-of-concept exploits for both.

The first vulnerability, tracked as CVE-2019-16662, resides in the ajaxServerSettingsChk.php, it can be exploited by a remote, unauthenticated attacker.
The second RCE, tracked as CVE-2019-16663, resides in the search crud.php and it could be only exploited by an authenticated attacker.

Askar reported the two vulnerabilities to the rConfig maintainers on September 19, but he received no reply, so after 35 days he decided to release the exploits.
Click to expand...

Log in or Sign up

Two unpatched RCE flaws in rConfig software expose servers to hack

guest Guest

Log in or Sign up

Two unpatched RCE flaws in rConfig software expose servers to hack

guest Guest

Useful Searches