CVE-2020-10221

What is rConfig?

rConfig is an open-source network device configuration management tool used by network administrators to back up, manage, and compare configuration files across routers, switches, and other network infrastructure — meaning a compromised rConfig instance can potentially expose or manipulate configuration data for an organization's entire network estate.

Overview

CVE-2020-10221 is an OS command injection vulnerability (CWE-78) in rConfig's lib/ajaxHandlers/ajaxAddTemplate.php. A remote attacker can inject and execute arbitrary operating system commands via shell metacharacters in the fileName POST parameter (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). It was one of several command injection and SQL injection vulnerabilities disclosed in rConfig around the same period, following a wave of security research into the platform.

Technical Details

The ajaxAddTemplate.php handler passes the fileName parameter into a system-level command without adequately sanitizing shell metacharacters, allowing an attacker to append additional commands to be executed alongside the legitimate operation.

Discovery

Publicly disclosed alongside a cluster of related rConfig vulnerabilities from independent security researchers examining the platform's AJAX handlers.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Public proof-of-concept exploits for rConfig's various 2020 vulnerabilities circulated quickly given the tool's straightforward, unauthenticated exploitation primitive, and its role managing network device configurations makes it a valuable target for attackers seeking broad visibility into and control over an organization's network infrastructure.

Remediation

1. Update rConfig to a version that addresses this and the related command injection/SQLi vulnerabilities from the same disclosure period.
2. Restrict network access to the rConfig web interface to trusted internal administrative networks; it should not be directly internet-facing.
3. Audit rConfig server logs for anomalous requests to ajaxAddTemplate.php and similar AJAX handlers containing shell metacharacters.
4. Treat any compromised rConfig instance as a network-wide incident, not a single-host compromise, given the sensitive configuration data it manages for your network estate — rotate any credentials embedded in stored device configurations.