CVE-2020-10221

This vulnerability lets an attacker make your rConfig server run “system commands” of their choice. It’s like handing someone a key to your computer’s command prompt, but only after they first log in with a basic account.
In practical terms, that can lead to total control of the machine (or at least the ability to do serious harm).

This matters if you use the software rConfig and it’s running a vulnerable version up through 3.94. Because attackers only need a low-privileged login (not admin rights), the risk is higher if user accounts exist and the rConfig interface is reachable.
Only treat it as a risk if the vulnerable rConfig version is reachable from the network and an attacker can authenticate as a low-privileged user.

This is RED because CISA listed CVE-2020-10221 in its KEV catalog, which means it’s been used in real attacks. Attackers can use it to run arbitrary operating-system commands, so successful exploitation can quickly lead to total compromise and disruption.

1. Confirm exposure

   • Identify the exact rConfig version in use. The vulnerable scope is “through 3.94”.
   • Confirm the service path/feature usage if your deployment documentation mentions template-adding or AJAX template functions.

2. Confirm reachability and authentication exposure

   • Determine whether the rConfig web interface is reachable from the internet or from any untrusted network.
   • Identify whether you have any low-privileged accounts that can access the affected functionality.

3. Upgrade to the fixed version

   • Upgrade rConfig to a vendor-supported release newer than 3.94 that explicitly fixes CVE-2020-10221.
   • Follow any vendor upgrade notes (e.g., configuration migrations, compatibility changes) and validate that the rConfig UI/API still works after the upgrade.

4. Temporary workaround if patching is delayed

   • Restrict network access to rConfig (allow only trusted IP addresses/VPN, block all other inbound traffic).
   • Reduce the chance of an attacker obtaining a low-privileged account: remove unused accounts, enforce strong passwords, and apply any available rate limiting / login throttling.

5. Validation after remediation

   • Re-check that the deployed version is no longer in the “through 3.94” range.
   • Confirm that the exposed endpoint behavior is unchanged for legitimate users, and that the service remains reachable only from approved networks.

6. CISA timing

   • CISA KEV remediation due date was 2022-05-03; given it’s already past, treat this as actively overdue for any exposed installation.

Severity is high: the flaw is command injection (CWE-78) in rConfig’s lib/ajaxHandlers/ajaxAddTemplate.php. An attacker can send malicious shell metacharacters via the fileName POST parameter and cause arbitrary OS command execution on the server. The attack requires low-privileged authentication (no user interaction), and the vulnerable functionality is reachable in default configurations.

CISA KEV confirms exploitation-in-the-wild (listed 2021-11-03) with a remediation due date of 2022-05-03, so this should be treated as an actively weaponized issue rather than a theoretical risk. Public PoC material exists, but the KEV listing is the stronger indicator for real attack activity.