CVE-2020-10879

What it actually does

Unauthenticated remote command injection: the nodeId parameter from GET requests to lib/crud/search.crud.php is passed directly to the exec() function without sanitization or escaping, allowing arbitrary OS commands to be executed with the privileges of the web server process.

Why it matters to the business

Attackers can gain full control of the rConfig server, read or alter network device configurations, pivot into managed infrastructure, and exfiltrate or destroy data; the high exploit availability and unchanged high EPSS score make this an immediate priority for any organization still running an affected version.

How an attack unfolds

An attacker issues a crafted GET request to the search endpoint supplying shell metacharacters or command payloads inside the nodeId parameter; because the value reaches exec() unfiltered, the operating system executes the attacker-supplied commands, returning output or establishing a reverse shell.

How to fix it

Upgrade every rConfig installation to version 3.9.5 or later; if an upgrade cannot be performed immediately, restrict network access to the application, disable the search functionality, or place the instance behind an authenticated reverse proxy that blocks or sanitizes the nodeId parameter.

How to confirm the fix worked

Confirm the installed version is 3.9.5 or newer; attempt a benign test payload against the search endpoint and verify that no command execution occurs; review web server logs for the absence of previously observed malicious nodeId patterns after the update.

Typical attack path

1. Identify an internet-facing or internally reachable rConfig instance
2. Send a GET request to /lib/crud/search.crud.php containing a malicious nodeId value that includes shell syntax
3. Observe command execution via returned output or side effects such as new processes or network connections
4. Escalate to persistent access, credential harvesting, or lateral movement within the managed network

How to detect it

Search web-server access logs for requests to lib/crud/search.crud.php that contain unusual characters or command strings in the nodeId parameter; examine process-creation or command-history logs on the host for unexpected exec calls originating from the web server user.

• /lib/crud/search.crud.php?nodeId=
• nodeId=
• exec(

What your security team should do

• Treat as high-priority patch; schedule upgrade within days given public exploit availability and stable high EPSS
• Scan the environment for any rConfig instances older than 3.9.5 and isolate them until patched
• Add web-application firewall rules that block or log requests containing shell metacharacters in the nodeId parameter
• Enable or increase logging of all requests to search.crud.php for ongoing monitoring