rConfig deserialization flaw in queue processing allows remote code execution
Anyone can hack the network device config tool without logging in!
Summary
rConfig is a network configuration management tool. A deserialization flaw in its queue processing lets unauthenticated remote attackers run arbitrary code on the server, affecting Core 8.0.0 before 8.2.19 and Pro before 8.4.1.
Affected when
- Redis queue (Laravel Horizon) running without authentication
- Redis reachable directly, or a signed-in user able to point a device target at the server's own address
What to do
Update rConfig Core to 8.2.20 or later and rConfig Pro to 8.4.1 or later. After updating, change API tokens and stored device, SMTP and other passwords, and check for accounts you don't recognise.
Update to at least the version for your product:
- rConfig Core 8.2.20 or later
- rConfig Pro 8.4.1 or later
Products and platforms
CVE IDs
Sources
- Advisory: rconfig.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen