CVE Catalog
CVE-2021-29006
MediumCVSS 6.5Exploitation Probability (EPSS)
Very high risk5.47%
92th percentile - higher than 92% of all known CVEs
Summary
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.
Risk Assessment
An attacker with access to the system can steal sensitive data such as configuration files, passwords, or private keys, leading to a security breach for the organization.
Recommendation
Immediately update rConfig to the latest version that fixes this vulnerability and restrict user permissions to the minimum necessary.
Original NVD description (English source)
rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server.